SSL Certificate Usage Process

Working Principles of an SSL Certificate

HTTPS adds the Secure Sockets Layer (SSL) protocol based on HTTP to encrypt information and data to ensure data transmission security. SSL supports one-way and two-way authentication.

• One-way authentication: When connecting to a server, a client verifies whether the server is correct.
  One-way SSL authentication applies to the scenario where the client only needs to verify the server identity. For example, in website access, user identity verification is not required at the communication layer, and the application logic layer can ensure security.

  Figure 1 One-way authentication
  
  1. The client sends information, such as an SSL protocol version, type of encryption algorithm, and random number, to the server.
  2. In addition to an SSL protocol version, type of encryption algorithm, and random number, the server returns a server certificate (public key certificate) to the client.
  3. The client verifies the validity of the server SSL certificate, including whether the server certificate expires, whether the CA of the issued server certificate is reliable, whether the public key of the CA can be used to correctly decrypt the CA digital signature of the server certificate, and whether the domain name in the server certificate matches the server's domain name (that is, the domain name accessed by the user). If the verification is successful, the communication continues. Otherwise, the communication ends.
  4. The client randomly generates a symmetric encryption key, encrypts the key using the server's public key (the server's public key is obtained from the server's certificate in step 2), and sends the encrypted key to the server.
  5. Upon receiving the encrypted information from the client, the server decrypts the information with the private key to obtain the symmetric encryption key.
  6. In the subsequent session, the client and server use the symmetric encryption key to communicate with each other, ensuring information security during the communication.
• Two-way authentication: When connecting to a server, a client verifies the server and the server also verifies the client.
  The two-way SSL authentication mechanism ensures that the server and client can verify each other's identity, which is mainly used to prevent man-in-the-middle attacks and ensure communication security and reliability. This mechanism is used in scenarios that require high security, such as banks, financial services, IoT, enterprise internal services, and government services, which involve privacy information or provide services only for specific clients.

  Figure 2 Two-way authentication
  
  1. The client sends information, such as an SSL protocol version, type of encryption algorithm, and random number, to the server.
  2. In addition to an SSL protocol version, type of encryption algorithm, and random number, the server returns a server certificate (public key certificate) to the client.
  3. The client verifies the validity of the server SSL certificate, including whether the server certificate expires, whether the CA of the issued server certificate is reliable, whether the public key of the CA can be used to correctly decrypt the CA digital signature of the server certificate, and whether the domain name in the server certificate matches the server's domain name (that is, the domain name accessed by the user). If the verification is successful, the communication continues. Otherwise, the communication ends.
  4. The server requests the client certificate, and the client sends the certificate and public key to the server.
  5. The server verifies the client certificate. If the verification is successful, the server continues the communication with the client. If the verification fails, the server disconnects from the client.
  6. The client randomly generates a symmetric encryption key, encrypts the key using the server's public key (the server's public key is obtained from the server's certificate in step 2), and sends the encrypted key to the server.
  7. Upon receiving the encrypted information from the client, the server decrypts the information with the private key of the server to obtain the symmetric encryption key.
  8. In the subsequent session, the client and server use the symmetric encryption key to communicate with each other, ensuring information security during the communication.

SSL Certificate Usage Process

Figure 3 and Table 1 show the certificate usage process.

Figure 3 Certificate usage process