EDUCBA

EDUCBA

MENUMENU
  • Free Tutorials
  • Free Courses
  • Certification Courses
  • 600+ Courses All in One Bundle
  • Login

What is SSL?

Home » Software Development » Software Development Tutorials » Network Security Tutorial » What is SSL?

What-is-SSL

Introduction to SSL

Secure Sockets Layer (SSL) is an encryption-based internet security protocol for establishing authenticated, encrypted links between networked computers to provide privacy and integrity to internet communications. It has been everywhere used to get the trust from the parties, for example when you search on the google, various websites has been open, each content lock sign at the left corner, this lock sign indicates that the particular site is secure to used. Many online businesses used this SSL concept to get the users trust.

What is SSL?

SSL stands for Secure Sockets Layer and it is a protocol that is being used to provide secure communications to a computer network. The protocol’s official name is now changed and replaced, it is known as TLS which stands for Transport Layer Security. While SSL was the foundation for TLS, it came as a replacement for the vulnerabilities that were discovered in SSL.

Start Your Free Software Development Course

Web development, programming languages, Software testing & others

In today’s world, there is information that is personal and secure and that needs to be protected against hackers and criminals. Exchange of information can happen between a server and a client (for e.g. a browser and a website) and also can happen with a network of servers.

Whenever a network or a website is secured by SSL, HTTPS appears in the URL. HTTPS stands for HyperText Transfer Protocol Secure. Also one can see a whole lot more details about the issuing authority of the SSL certificate and the corporate name of the website owner by clicking on the top left lock symbol that appears on the browser bar.

SSL 2

Working of SSL (How a secure connection is established)

working of ssl

The basic approach that is being used behind the SSL is when you enable and install an SSL certificate on a server and when a client, say the web browser tries to connect with it, the SSL certificate triggers an SSL protocol which encrypts all the data between the client and the server. There is an SSL handshake that happens between the client and the browser which is invisible to the users. In order to set up the SSL connection, three keys are required: the private key, the public key, and the session keys.

The rule is:

Anything which is encrypted with the help of a public key can only be decrypted by the private key and vice versa. Once the connection is established, the session key is being used to encrypt all the data.

Popular Course in this category
All in One Software Development Bundle (600+ Courses, 50+ projects)600+ Online Courses | 3000+ Hours | Verifiable Certificates | Lifetime Access
4.6 (3,144 ratings)
Course Price

View Course

Related Courses
CDN Training (2 Courses)OSPF Training Program (2 Courses)Penetration Testing Training Program (2 Courses)

There are different algorithms that are used for encrypting the data in SSL and Symmetric algorithms supported in SSL are Camellia, DES, 3DES, RC2, ARCFOUR, AES, IDEA, SEED, NULL (i.e. no encryption).

what are the steps involved in establishing a secure connection via SSL?

Following are the steps that are involved in establishing a secure connection via SSL:

  1. The web browser i.e. the client connects to the server that is secured with an SSL. The browser/client requests for server identification.
  2. Next, the server sends the SSL certificate that is issued by CA to the client. Along with the certificate, the server also sends its public key.
  3. The client i.e. the browser receives the copy of the certificate and then it verifies the different properties i.e. checks for expiry, revokes, and validity. If the resulting check is trusted, a symmetric session key is sent back to the client which is encrypted using the server’s public key.
  4. The server then decrypts the symmetric session key using its private key. An acknowledgment is also sent back which is encrypted with the session key.
  5. Once the secure connection is established, all the transmitted data is encrypted with the help of session key.

Features of SSL and Security Provided

SSL/TLS provides features for data encryption, authentication, and the integrity of data.

When a data is encrypted with SSL that basically means:

  • The sent data/message is not read by anybody
  • The message/data is not modified by anybody
  • The message/data is sent to the intended recipient.

In order to make sure that the message has reached the recipient and no one has modified it, SSL encrypts this and also signs it.

Both the process requires the use of keys.

Public, Private, and the Symmetrical Keys

Public Private and the Symmetrical keys

  • Public Key – A public key converts message into an unreadable format using algorithms and only the person who is having the public key can encrypt the message. On the other end, the receiver is having a private key, with the help of which he can decrypt the message.
  • Private Key – The private key is being used to decrypt the message which was encrypted using the public key.

Example:

The public key, as the name suggests, is available to everyone who is having access to the repository.

A public key, more or less could look like below:

1048 0141 03C9 18FA CA8D EB2D EKD5 FD37 89B9 M069 EA97 FC20 5E35 F577 EE31 C4FB C6B4 4811 7A86 BC8F BAFA 362F 922B F01B 2K40 C744 2654 C0DD 2881 D673 CA2B 4013 C266 E2ED CB02 0201 0011.

Going with the most famous example, if Bob would like to send sensitive information to Alice, he will encrypt the data with Alice’s public key. By doing this, he would make sure that only Alice should be able to read it. While on the other side, only Alice has access to the corresponding Private Key. So only the person with the private key has the capability to decrypt the encrypted data.

Keys and Certificates

In the public/private key cryptography, how do we know that the public key belongs to the entity that has claimed it?

The digital certificate is the answer to this.

digital certificate

A digital key is like an electronic password that provides a link between the public key and entity (like the company, business) which is verified. Digital certificates are the preferred way of distributing public encryption keys that are trusted.

How Digital Certificates are obtained?

Digital certificates can be obtained from any of the recognized Certificate Authority or CA.

Some of the popular certificate authorities companies are:

  • Comodo SSL.
  • DigiCert.
  • Entrust Datacard.
  • GeoTrust.
  • GlobalSign.
  • GoDaddy.
  • Network Solutions.
  • RapidSSL

In order to get the certificate, the business of the entity is required to fill out the form, add public keys and these are to be sent to the Certificate Authority. In turn, the certificate authority will run some checks and they will send back the key which will be enclosed in the certificate.

The certificate which comes is signed by CA (Certificate Authority).

Types of Digital Certificates

Digital certificates are mainly of two types:

  • Extended Validated Certificates (EV)

The EV or the extended validated certificates are used for HTTPS websites and also for the software. The EV provides a legal entity for controlling the software package and the website.

  • Domain Validated Certificates (DV)

In the case of DV or the domain validates certificates, the identity of the business or the entity is validated by putting some control over the DNS domain. The DV is a typical X.509 digital certificate.

Steps for determining a valid SSL certificate

In order to determine if the website is having an SSL certificate or the valid SSL certificate (Which means trusted and not expired), below are a few of the checks that can be done:

  1. The major difference is the “HTTP” (i.e. HyperText Transfer Protocol) and the “HTTPS” (i.e. HyperText Transfer Protocol Secure) which says which connection is secured by SSL. An HTTP will always be displayed before any website address if it is SSL secured. While if the website isn’t having any security, its address will be displayed with HTTP.
  2. A padlock symbol can be seen if the website is SSL secured.
  3. Also one can see a whole lot more details about the issuing authority of the SSL certificate and the corporate name of the website owner by clicking on the top left lock (i.e. padlock) symbol that appears on the browser bar.

Where one should use SSL?

The SSL should be used everywhere where we are transmitting data or information over a network, especially if the information is a sensitive one.

Examples:

  1. Intranet communication – To secure information that is exchanged within the organization’s intranet.
  2. Internet – To secure information that is exchanged over the internet. For e.g. the communication between a web browser and a server.
  3. For securing the exchange of information between server to server or over a network of servers.
  4. Cloud Computing.
  5. Securing information that is sent over mobile, tablets, etc.
  6. Email communications and many more.

The Advantages and Benefits of SSL Certificates

As we have learned, SSL is a protocol that is being used to provide secure communications to a computer network. Following are the advantages of using SSL:

1. To wipe out all attempts made by the bad guys, the “Hackers”

There is a number of phishing sites that are available today and are being created, so we need to be very much cautious about phishing sites. In many cases, you might see the exact replica of the original website that is being made available to you in order to fake you. But as far as SSL certificates are concerned, they will make sure that no such things happen as it is impossible for the fake websites to get an SSL certificate approved and signed by CA. Along with this, SSL will also protect you from other threats such as “man in the middle attack” and eavesdropping.

2. Search Engines Ranking and Increase of users presence

Many of the search engines such as Google have updated their algorithm to a rank website to appear in the search result based on certain parameters and one of them is an SSL secured website. Any website with SSL security will get ranked before the website which is not having any security, which means, when uses will search for information, SSL secured website will be displayed at the first in search results while NoNSSL websites will be displayed in the last.

Another big advantage is of gaining users’ and customers’ trust. A website secured with SSL gains users’ trust and they are less worried about the security aspect of the website and they do not fear while browsing through the website.

3. Secure Payments gateway and Safe Shopping

It is mandatory for any business site to obtain an SSL certificate. When it comes to money and cash transfers, it becomes utmost to provide a secure tunnel between the buying entity and the selling entity whosoever is involved in the business. A business operating without an SSL certificate is almost targeted for attacks by hackers. Without a secure connection, no user will ever gain the confidence of submitting their credit card numbers for the sake of transaction.

4. More Security and Extended Authentication

With increasing cyber attacks across the world, customers, as well as Ethical hackers, are also becoming more and more secure in their role to prevent any mishappening. There is a whole lot of sensitive information that is exchanged over a network such as passwords, personal details, business deals, etc. So a secure authentication must be provided to ensure communication is well protected. This added security is achieved by issuing a server certificate along with the SSL certificate.

5. More Robust Encryption for Secure of the Information

All the information that is transferred over an SSL connection is encrypted with robust and complex algorithms. It is almost impossible to decipher them. The encryption algorithms that are mostly used by certificate authorities are RSA, DSA, and ECC. Any sensitive information such as passwords or credit card numbers, when sent over a network will be secured with robust encryption and that will not allow the hackers to crack it.

Conclusion

In this article, we have gained a good understanding of the SSL and how it works. We also learned about the public and private keys that are being used in encryption algorithm of SSL and then we learned where we can use SSL. Finally, we wrapped up our article by seeing the benefits of the SSL.

Recommended Articles

This has been a guide to the What is SSL?. Here we discussed the Key Concept, Features, Working, Benefits, and Steps for determining a valid SSL certificate. You can also go through our other suggested articles to learn more –

  1. What is MapReduce in Hadoop?
  2. What Is Django?
  3. What is Cyber Security?
  4. Digital Certificate

All in One Software Development Bundle (600+ Courses, 50+ projects)

600+ Online Courses

3000+ Hours

Verifiable Certificates

Lifetime Access

Learn More

0 Shares
Share
Tweet
Share
Primary Sidebar
Network Security Tutorial
  • Advanced
    • Cryptosystems
    • Configuring DHCP Server
    • Block Cipher modes of Operation
    • TCP/IP Model
    • Types of Network
    • Types of Network Devices
    • Types of Network Topology
    • Types of Intrusion Prevention System
    • Types of Proxy Servers
    • Types of Websites
    • Types of NAT 
    • Mobile IP
    • Career in Automobile Design
    • What is TFS
    • What is NAT
    • What is OSI Model
    • Data Link Layer OSI Model
    • What is Cross Site Scripting
    • Applications of Sensors
    • ARP Packet Format
    • Asymmetric Information
    • Autoencoders
    • What is FTP Server?
    • IPS Tools
    • IPv4 Header Format
    • IPv6 Header Format
    • Authentication Header
    • Kerberos
    • Network Mapper
    • Network Scanning Tools
    • Network Mapping Tools
    • Network Access Control
    • Network Sniffer
    • Networking Commands
    • Networking Devices
    • Networking Strategies
    • Digital Certificate
    • What is a Digital Signature?
    • Digital Signature Softwares
    • Digital Signature Types
    • Digital Signature vs Digital Certificate
    • PKCS
    • What is FTP
    • FTP Commands
    • What is MIME?
    • What is Smart Card?
    • Networking Ports
    • Mutual Authentication
    • Password Authentication
    • Data Masking 
    • Authentication Tokens
    • Biometric Authentication
    • What is IP?
    • IPSec
    • Secure Electronic Transaction
    • What is CIDR
    • Static Binding and Dynamic Binding
    • What is SSL
    • PKIX
    • Public Key Infrastructure
    • What is Wireshark
    • SNMP Monitoring Tools
    • Network Analysis Tools
    • Server Monitoring Tools
    • Network Discovery Tools
    • Network Management Tool
    • SIEM Tools
    • OSINT Tools
    • Multiple Ping Tool
  • Basics
    • Security Consultant Definition
    • Security Policies
    • What is Network Security
    • What is Data Security?
    • What is Cryptography
    • Cryptography Techniques
    • Cryptography Tools
    • Data Security Techniques and Privacy
    • Digital Signature Cryptography
    • Java Cryptography
    • Basics of Cybersecurity
    • What is Network Topology
    • Algorithms and Cryptography
    • HTTP Methods
    • Security Technologies
    • Security Architecture
    • Network Topologies
    • What is a Physical Address?
    • Logical Address
    • What is Storage Area Network?
    • Mobile Ad Hoc Network
    • What is Computer Networks?
  • Protocols
    • What is TCP Protocol
    • What is TCP/IP
    • How do IP Addresses Work?
    • Routing Protocols Types
    • What is Telnet
    • What is TFTP
    • What is DHCP
    • What is SFTP
    • Address Resolution Protocol
    • Internet Control Message Protocol
    • Simple Mail Transfer Protocol
    • Internet Security Protocols
    • SMTP Protocol
    • Types of Networking Protocols
    • User Datagram Protocol
    • Data Link Layer
    • Transport Layer Protocols
    • What Is Networking Protocols
    • TFTP
    • What is ARP
    • Basic Fundamental Of Networking
    • What is IPv4
    • What is IPv6
    • CIFS Protocol
    • What is SMB?
    • What is EIGRP
    • What is LLDP?
  • Routing
    • What is Router
    • Types of Routers
    • Dynamic Routing
    • Routing Algorithms
    • Routing Protocol
    • What is Routing
    • What is Static Routing
    • Important Types of DNS Servers (Powerful)
  • Attacks
    • Types of Network Attacks
    • What is Trojan Horse Virus
    • What is DOS
    • Types of DOS Attacks
    • DDos Attack Mitigation
    • Ransomware Attack  
    • Types of Cyber Attack
    • What is a Brute Force Attack
    • What is a Phishing Attack
    • What is Cyber Attack
    • What is DDoS Attack
    • What is Man In The Middle Attack
    • What is Man In The Middle Attack
    • What is Ransomware
    • What is Pharming
    • What is Phishing
    • What is CSRF
    • DNS Amplification Attack
    • Denial of Service Attack
  • Algorithm
    • IDEA Algorithm
    • MD5 Algorithm
    • Symmetric Algorithms
    • Diffie Hellman Key Exchange Algorithm
    • Digital Signature Algorithm
    • Encryption Algorithm
    • Advanced Encryption Standard
    • Asymmetric Encryption
    • ElGamal Encryption
    • HMAC
    • DES Algorithm
    • Brute Force Algorithm
    • SHA Algorithm
    • RSA Algorithm
    • What is Digital Certificate?
    • Certificate Revocation
    • RC5
  • Encryption/ Decryption
    • Encryption process
    • Public Key Encryption
    • Symmetric Key Encryption
    • What is Encryption
    • What is Decryption
    • Types of Cipher
    • Transposition Techniques
    • What is Steganography
    • One Time Pad
    • Steganography Techniques
  • Hosting
    • Types of Web Hosting
    • Free Web Hosting Sites
    • What is Hosting
    • What is VPS Hosting
    • What is Web Hosting
    • Types of Domain
    • VPN Applications for PC
    • Why we use VPN?
    • What is Virtual Host?
  • Firewalls
    • What is a Firewall?
    • Types of Firewalls
    • Firewall Devices
    • Firewall Uses
  • Interview Questions
    • Network Security Interview Questions
    • Networking Interview Questions
    • EIGRP Interview Questions

Related Courses

CDN Training

OSPF Certification Training

Penetration Training Course

Footer
About Us
  • Blog
  • Who is EDUCBA?
  • Sign Up
  • Corporate Training
  • Certificate from Top Institutions
  • Contact Us
  • Verifiable Certificate
  • Reviews
  • Terms and Conditions
  • Privacy Policy
  •  
Apps
  • iPhone & iPad
  • Android
Resources
  • Free Courses
  • Java Tutorials
  • Python Tutorials
  • All Tutorials
Certification Courses
  • All Courses
  • Software Development Course - All in One Bundle
  • Become a Python Developer
  • Java Course
  • Become a Selenium Automation Tester
  • Become an IoT Developer
  • ASP.NET Course
  • VB.NET Course
  • PHP Course

© 2020 - EDUCBA. ALL RIGHTS RESERVED. THE CERTIFICATION NAMES ARE THE TRADEMARKS OF THEIR RESPECTIVE OWNERS.

EDUCBA
Free Software Development Course

Web development, programming languages, Software testing & others

*Please provide your correct email id. Login details for this Free course will be emailed to you
Book Your One Instructor : One Learner Free Class

Let’s Get Started

This website or its third-party tools use cookies, which are necessary to its functioning and required to achieve the purposes illustrated in the cookie policy. By closing this banner, scrolling this page, clicking a link or continuing to browse otherwise, you agree to our Privacy Policy

EDUCBA

*Please provide your correct email id. Login details for this Free course will be emailed to you
EDUCBA Login

Forgot Password?

EDUCBA
Free Software Development Course

Web development, programming languages, Software testing & others

*Please provide your correct email id. Login details for this Free course will be emailed to you

Special Offer - All in One Software Development Bundle (600+ Courses, 50+ projects) Learn More