Tuesday, 16 January 2024

one way SSL (browser sever) two way SSL authentication + encryption

 https://dzone.com/articles/implementing-one-way-and-two-way-ssl-mutual-authen


One Way SSL

As mentioned above in one way SSL only client verifies the server certificates. At the server end, there will be a Keystore that will hold the private and public certificate of the server whereas, at the client end, there will be a truststore that will hold the public certificate of the server.

  • Clients will send Hello and request for the resources on the secure HTTPS protocol.
  • The server will respond with its public certificate (.crt) and send Hello.
  • The client will verify the server public certificate in its truststore.
  • The client sends back symmetric session key generated using the server public certificate.
  • The server will decrypt the symmetric session key using its private key and send back the encrypted session key encrypted to the client for establishing a secure connection.

Two Way SSL (Mutual Authentication)

As mentioned above in two ways SSL client verifies the server certificates and the server verifies the client certificates. 

At the server end, there will be a Keystore which will hold the private and public certificate of the server and truststore which will hold the public certificate of client whereas, at the client end, there will be a Keystore which will hold the private and public certificate of client whereas truststore which will hold the public key of the server.

  • Clients will send Hello and request for the resources on the secure HTTPS protocol.
  • The server will respond with its public certificate (.crt) and send Hello.
  • The client will verify the server public certificate in its truststore.
  • The client sends back symmetric session key generated using the server public certificate.
  • The server will decrypt the symmetric session key using the server private key and request for the client certificate.
  • The client will send its public certificate to the server and the server will verify the client public certificate in the server truststore.
  • The server will generate a session key and encrypt using the client public certificate and send it to the client.
  • The client will decrypt the session key using client private certificate and this way the key exchange between client and server. It will establish secure communication between client and server.

once session key is created, data encrypted with session key and using algorthim


TLS is just upgraded version of SSL

No comments:

Post a Comment