Recently faced some weird issues with ssl, while building a new infrastructure. So this will be a post on SSL basics which actually is sufficient to fix even crazy error like "SSLHandshakeException". For guys wondering what is that, I too have no idea abt it. Its computer way of saying, go and read basics before bugging me.
Browser based Handshakes(One way cert validation):
Say I open gmail.com, browser sends a request to gmail.com, gmail.com will give me a certificate that will have hostname(gmail), validity of certificate, public key of gmail.com and a hash to make sure data is not tampered. Browser uses the public key to encrypt data to gmail which can be decrypted only with gmail's private key. Similarly gmail sends data encrypted with its private key which can be decrypted with its public key which the browser has.
SSL Session:
But everybody will have gmail's public key. What if any culprit decrypts data from gmail and reads it? So at the start of https connection a session is established, meaning once the server sends a cert, the client creates its own key(mostly symmetric ones Read DSA,RSA) which is valid for this session. The client then sends this key encrypted with the public key of the server thereby preventing man in the middle
Fake Server:
Say you request for gmail.com, if the DNS server is infected by a malware, it will redirect to some fake server, the fake server will be able to produce a cert impersonating as gmail.com and keys. This will lead to loss of passwords or confidential info. To avoid this, a trusted third party called CA(Certificate Authority) comes into picture. There are lot of commercial CAs like verisign. The browser will have public keys of trusted CA. Gmail's cert will be signed with the private key of one of the trusted CAs. So if I request gmail.com, gmail will send its cert signed with CA's private key. Now you open cert with CA's public key and then find gmail's public key. Its like double protection and the quality of protection depends on the reliability of CA. So that if you visit certain https site which dont use trusted CAs to sign their certificate, the browser would warn you.
Fake Client:
This case is not typically handled in our day to day activities. Whenever you visit gmail.com, you are authenticated as a valid client by application logics like passwords/cookies, not by ssl layer.
But there might be a case like I run a set of clients who periodically gets configuration(set of tasks) from a server. In such a case, the clients will also get their cert signed by CA, once the server is authenticated , the client sends its cert with the public key of server, the server decrypts with its private key, then with CA's public key and then validates client.
Confused?? The diagram below should put things in place
Fake Server:
Say you request for gmail.com, if the DNS server is infected by a malware, it will redirect to some fake server, the fake server will be able to produce a cert impersonating as gmail.com and keys. This will lead to loss of passwords or confidential info. To avoid this, a trusted third party called CA(Certificate Authority) comes into picture. There are lot of commercial CAs like verisign. The browser will have public keys of trusted CA. Gmail's cert will be signed with the private key of one of the trusted CAs. So if I request gmail.com, gmail will send its cert signed with CA's private key. Now you open cert with CA's public key and then find gmail's public key. Its like double protection and the quality of protection depends on the reliability of CA. So that if you visit certain https site which dont use trusted CAs to sign their certificate, the browser would warn you.
Fake Client:
This case is not typically handled in our day to day activities. Whenever you visit gmail.com, you are authenticated as a valid client by application logics like passwords/cookies, not by ssl layer.
But there might be a case like I run a set of clients who periodically gets configuration(set of tasks) from a server. In such a case, the clients will also get their cert signed by CA, once the server is authenticated , the client sends its cert with the public key of server, the server decrypts with its private key, then with CA's public key and then validates client.
Confused?? The diagram below should put things in place
Comments
Post a Comment