What is SSL

by

In this article, we have covered multiple things about the SSL, like: ssl certificate, need of ssl & ssl certificate, encryption types, how we can get ssl certificate etc.

Introduction to SSL

Secure Sockets Layer (SSL) is a network protocol designed to secure connections between web clients and web servers over an insecure network such as the Internet. Netscape officially introduced SSL in 1995, making it the first widely used protocol for securing online transactions between consumers and businesses. Eventually, it was used to secure authentication and encryption for other applications at the transport layer of the network.

In addition to securing Internet connections, SSL is also used to authenticate and encrypt other applications at the transport layer of the network. In general, SSL is about securing connections between a web browser (client) and a website (server). It has facilitated secure transactions between consumers and businesses and helped lay the foundation for e-commerce. Without SSL, data sent to and from a website can be intercepted by a cybercriminal.

SSL uses public and private key encryption and other cryptographic functions to secure connections between devices communicating over a TCP/IP network.SSL can encrypt plain text entered on a website using asymmetric cryptography and public-key cryptography. This is just one of the ways modern businesses are using Public Key Infrastructure (PKI).

Importance of SSL

SSL is important because it was the first way for computers to talk to each other in a secret way that lots of people could use. Netscape created a secret code to keep websites safe. They decided to share the code with other companies, even though they were competing against them. This helped Netscape get more customers and made sure that the code became a standard rule for everyone to use. When you go on the internet, you use something called HTTP to connect to websites. But, HTTP isn’t very safe because bad people can easily see your personal information, like your name and credit card number. So, a new and safer way called HTTPS was created to protect your information when you use the internet. When you go on some websites, you might see a little “s” at the beginning of the web address. This means the website is really safe and keeps your information private.

What is an SSL certificate?

An SSL certificate is a digital certificate that verifies the identity of a website and enables an encrypted connection. SSL stands for Secure Sockets Layer, a security protocol that creates an encrypted connection between a web server and a browser.

Simply put, SSL protects internet connections by preventing hackers from reading or altering data sent between two systems. When the URL in the address bar has a padlock icon next to it, SSL is being used to secure that particular website.

When you want to talk safely with someone online, you have to make sure your computer and their computer are set up to talk in a special way called SSL. To make sure you’re really talking to the right person, your computer has to check with a special authority to make sure everything is okay. This special authority has a special certificate that your computer checks. If the person you’re talking to has a special certificate too, your computer checks that to make sure it’s really them. If they don’t have a special certificate, your computer asks for a copy of their certificate to check it.

To make sure that the computer talking to another computer is really who they say they are, they need a special “permission slip” called a certificate. There are two kinds of certificates they can use, one from a special company called a CA or one that they make themselves. They also need another special certificate that comes with their computer. To make sure websites are safe, they need a special certificate called an SSL. To get this certificate, the website owner has to ask a trusted company for it and give them some information. This certificate helps keep the website and its visitors secure.

How to Obtain an SSL/TLS Certificate?

The following is the fundamental procedure for acquiring a publicly trusted SSL/TLS website certificate

  • Public and private keys are generated by the person or organisation making the certificate request, and they must be kept on the server being secured.
  • The public key, the domain name(s) to be protected, and (for OV and EV certificates) organisational information about the company requesting the certificate (CSR) are used to create a certificate signing request.
  • The CSR is delivered to a publicly reputable CA (like SSL.com). The requester can install the signed certificate that was produced by the CA on their web server after the CA has verified the data in the CSR.

What is Asymmetric Encryption?

Asymmetric encryption, also referred to as public key cryptography or SSL cryptography, encrypts and decrypts data using two different keys. With asymmetric encryption, anyone can use the public key to encrypt a message. However, decryption keys are kept private. This way only the intended recipient can decrypt the message.

RSA is the most widely used asymmetric encryption algorithm. RSA stands for Ron Rivest, Adi Shamir, and Leonard Adleman— the men who first publicly used the algorithm in 1977. Asymmetric keys are typically 1024- or 2048-bits. However, keys smaller than 2048-bits are no longer considered safe to use. With 617 digits in use, 2048-bit keys have a large number of distinctive encryption codes.

Although larger keys can be generated, they are rarely used because of the significant increase in computational complexity. To put that into perspective, breaking a 2048-bit certificate would take an average computer more than 14 billion years.

What is Symmetric Encryption?

One key is used for both data encryption and decryption in symmetric encryption (also known as pre-shared key encryption). The same key is required for communication between the sender and the recipient. The standard symmetric key size is 128 or 256 bits; the greater the key size, the more difficult it is to decrypt. For example, a 128-bit key has 340,282,366,920,938,463,463,374,607,431,768,211,456 encryption code possibilities. You can see that it would take a lot of time to break a 128-bit key using a “brute force” assault, which involves trying every key until the attacker finds the correct one. The encryption capabilities of both the server and the client software determine whether a 128-bit or 256-bit key is utilised. The choice of key size is independent of TLS/SSL certificates.

Types of Trust

There are two supported levels of trust for SSL certificates:

  1. CA Trust: Trust hierarchy built on a root certificate that is used to issue further certificates. This model is the standard SSL certificate trust model.
  2. Direct Trust: Direct trust of certificates that have been signed by oneself that are assumed to be distributed using secure out-of-band methods. Although they are not included in the SSL standards, direct trust and self-signed certificates are widely used in some trading communities.

Steps involved in the secure sockets layer process

There are multiple steps involved in the SSL process, including the following:

  1. Initial connection: When a user, let’s say a client, logs onto Brand A’s website, the user’s web browser tells Brand A’s server that the user wants to create a private connection. In response to this message, the Brand A server transmits its SSL certificate, which contains its public key.
  2. Certificate authentication: Brand A’s server presents its SSL certificate to the client as part of the initial handshake procedure to establish trust. That would be the client’s web browser in this situation. The Public Key Cryptography Standards’ 509 certificate format is used by server certificates. The customer is connecting with the intended server, according to the web browser, which examines the certificate. Digital certificates are validated using public key encryption, and servers’ authenticity is also confirmed using this method. To speed up the procedure, most online browsers will automatically believe SSL certificates that have been issued by a CA.
  3. The user’s message is encrypted using Brand A’s public key after the browser, or client, has verified the authenticity of the web server and its certificate. It is then delivered to Brand A’s server.
  4. The communication is decrypted by Brand A’s server using its own private key. A symmetric session key is included in the message to create a two-way handshake between the two entities.
  5. Cipher settings and shared encryption key: The client and server decide on cypher settings and a shared key to encrypt the data they exchange for the remainder of the session after the server has been authenticated. Data integrity and confidentiality are provided through this. The customer is unaware of this process. For instance, if a webpage needs an SSL connection, the URL will switch from HTTP to HTTPS, and once the server has been verified, a lock icon will show up in the browser.
  6. Client authentication: The handshake also enables the client to establish its own server authentication. In this case, before the encrypted SSL session can be established, the client must first present its certificate to the server for server authentication to be complete.

Services Offered by SSL:

SSL offers several services on information obtained from the application layer, including:

  1. Fragmentation: The data is first separated into blocks by SSL that are 214 bytes or shorter.
  2. Compression: Every data fragment is compressed using one of the lossless compression methods that the client and server have agreed upon. There is no need for this service.
  3. Message Integrity: To safeguard the data’s integrity, SSL creates a MAC using a keyed-hash function.
  4. Confidentiality: In order to guarantee confidentiality, both the original data and the MAC are strictly encrypted using symmetric-key cryptography.
  5. Framing: A header is received by the encrypted payload. After that, a dependable transport-layer protocol receives the payload.

Used Algorithms by SSL

  • Key Exchange Algorithm: To exchange a trusted and private communication, each client and server needs to have their own set of cryptographic secrets. However, in order to develop these secrets, the two parties must first produce one pre-master secret. In order to establish this pre-master secret, one of the key-exchange techniques recommended by SSL is used.
  • Encryption/Decryption Algorithm: Both the client and the server must also agree on a set of encryption and decryption methods.
  • Hash Algorithm: SSL uses hash algorithms to guarantee message integrity (message authentication). Numerous hash algorithms have been developed as a result.
  • Cipher Suite: As a result of the interaction between the key exchange, hashing, and encryption algorithms, each SSL session has a distinct cypher suite.
  • Compression Algorithm: Compression is not necessary for SSL. There is no defined compression algorithm. Therefore, a system is free to use any compression technique it sees fit.

Types of SSL certificates

Extended Validation (EV SSL), Organisation Validated (OV SSL), and Domain Validated (DV SSL) are the three types of SSL certificates that are available. The techniques used to check applicants for the certificates vary, but their encryption levels remain the same. Here are a few examples of the variations:

  • Single-domain: A single domain is covered by a single domain SSL certificate.
  • Wildcard: A wildcard SSL certificate only covers one domain, just like a single-domain certificate does. But it also includes the subdomains of that site. A single-domain certificate could only protect the first domain, whereas a wildcard certificate could protect www.cloudflare.com, blog.cloudflare.com, and developers.cloudflare.com.
  • Multi-domain: This multi-domain SSL certificates can be applied to multiple unrelated domains.

Validation Levels

SSL certificates has different levels for validation:

  • EV SSL: This confirms the applicant’s legitimacy to use the domain in question as well as its existence and identity. To obtain one, you must submit a number of other paperwork and pass background checks. Obtaining this certificate may take five or more business days.
  • OV SSL: This verifies the applicant’s right to use the domain and performs some organisation vetting. It can take two to five days to obtain.
  • DM SSL: This validates the identity of the requester. Data about the company is not verified. It merely needs the request’s confirmation by email or the internet. In a few hours, you can get it.

Sub Protocols Used in SSL

  • SSL Record Protocol: SSL Record provides Confidentiality and Message Integrity to the SSL connection.
    • In this Protocol, application data is separated into fragments. The fragment is compressed before having a MAC (Message Authentication Code) that has been encrypted and created using the Secure Hash Protocol (SHA) and the Message Digest (MD5) algorithms appended. After that, the data is encrypted, and at the end, an SSL header is appended to the data.
  • Handshake Protocol:
    • Sessions are established using the Handshake Protocol. By exchanging a series of messages to one another, this protocol enables the client and server to verify one another’s identities.
  • Change-cipher Spec Protocol:
    • The SSL record protocol is used by this protocol. Unless Handshake Protocol is completed, the SSL record Output will be in a pending state. The Pending state is changed into the current state using the handshake process.
    • Each communication in the change-cipher protocol is one byte long and limited to having only one value. The goal of this protocol is to copy the pending state into the live state.
  • Alert Protocol:
    • Alerts pertaining to SSL are transmitted to the peer entity using this protocol. In this protocol, each message consists of two bytes.

Leave a Comment