What is SSL?
the Secure Sockets Layer (SSL) protocol, originally developed by Netscape,
has become the universal standard on the Web for authenticating Web sites
to Web browser users, and for encrypting communications between browser
users and Web servers. Because SSL is built into all major browsers and
Web servers, simply installing a digital certificate, or Server ID, enables
SSL capabilities.
What is a Server ID?
Installed on your Web server, a Server ID is a digital credential that
enables visitors using Web browsers to verify your site's authenticity
and to communicate with it securely via SSL encryption.
What are authentication and encryption?
SSL server authentication allows users to confirm a Web server's
identity. SSL-enabled client software, such as a Web browser, can
automatically check that a server's certificate and public ID are
valid and have been issued by a certificate authority (CA) - such
as VeriSign - listed in the client software's list of trusted CAs.
SSL server authentication is vital for secure e-commerce transactions
in which users, for example, are sending credit card numbers over
the Web and first want to verify the receiving server's identity. An encrypted SSL connection requires all information sent
between a client and a server to be encrypted by the sending software
and decrypted by the receiving software, protecting private information
from interception over the Internet. In addition, all data sent over
an encrypted SSL connection is protected with a mechanism for detecting
tampering - that is, for automatically determining whether the data
has been altered in transit. This means that users can confidently
send private data, such as credit card numbers, to a Web site, trusting
that SSL keeps it private and confidential.
How do Server IDs work?
1) A customer contacts your site and accesses a secured URL: a page secured
by a Server ID (indicated by a URL that begins with "https:" instead of
just "http:" or by a message from the browser). 2) Your server responds, automatically sending the customer
your site's digital certificate, which authenticates your site. 3) Your customer's Web browser generates a unique "session key" to encrypt
all communications with the site. 4) The user's browser encrypts the session key itself with the site's
public key so only the site can read the session key. 5) A secure session is now established. It all takes only seconds and
requires no action by the user. Depending on the browser, the user may
see a key icon becoming whole or a padlock closing, indicating that the
session is secure.
|
