Understanding SSL Certificates

X.509

X.509 is a standard defining the format of public key certificates. An X.509 certificate is a digital certificate that uses the widely accepted international X.509 public key infrastructure (PKI) standard to verify that a public key belongs to the hostname/domain, organization, or individual contained within the certificate. The X.509 certificate is either signed by a publicly trusted Certificate Authority (Like DigiCert, Sectigo, GlobalSign, etc.) or self-signed. When a certificate is signed by a trusted certificate authority, or validated by other means, someone holding that certificate can rely on the public key it contains to establish secure communications with another party or validate documents digitally signed by the corresponding private key. When a certificate is self-signed, it will not be trusted for public-facing applications and is mainly used to encrypt and authenticate data within an organization’s network.

Every certificate has two keys, a private key and a public key, and the two are known as an exchange key pair. In brief, the private key is known only to the owner of the certificate while the public key is readable from the certificate. Either key can be used to encrypt or decrypt a digest, hash, or other keys, but only as contrary operations. For example, if the client encrypts with the public key, only the site can decrypt the message using the private key. Similarly, if the site encrypts with the private key, the client can decrypt with the public key. This provides assurance to the client that the messages are being exchanged only with the possessor of the private key because only messages encrypted with the private key can be decrypted with the public key. The site is assured that it is exchanging messages with a client that has encrypted using the public key.

SSL/TLS Certificate 

X.509 certificates are used in many Internet protocols, including TLS/SSL, which is the basis for HTTPS. SSL and TLS are both network protocols that allow data to be transferred privately and securely between a web server and a web browser. 

With SSL/TLS being the majority use case of X.509 certificate use cases, we’ll clarify the difference between SSL and TLS.

Secure Sockets Layer (SSL) is the predecessor to TLS

SSL is a cryptographic protocol designed to secure network communications. Netscape introduced SSLv2.0 in 1995, and after vulnerabilities were discovered, SSLv3.0 was created. In 1999 TLS v1.0 was introduced after SSLv3 was considered insecure due to the POODLE attack. The POODLE attack exploiting SSLv3 in 1999 created the introduction of TLS v1.0. Some applications, such as browsers, are compatible with some of the SSL protocol versions, although SSL has been phased out in favor of the better TLS security.

Transport Layer Security (TLS) is the CURRENT encryption standard

Like SSL, TLS is a cryptographic protocol used by websites to secure communications between their servers and web browsers. TLS replaced the older SSL protocol as the encryption standard protocol. This change was made mostly to avoid legal issues with the Netscape company, creator of SSL, so that the protocol could be developed as an open standard, free for all. TLS v1.3 is the current default standard protocol.

SSL/TLS Certificates are X.509 certificates

SSL/TLS Certificates are X.509 certificates with Extended Key Usage: Server Authentication (1.3.6.1.5.5.7.3.1). Other common usage types of X.509 certificates are Client Authentication (1.3.6.1.5.5.7.3.2), Code Signing (1.3.6.1.5.5.7.3.3), and a handful of others are used for various encryption and authentication schemes.

SSL Handshake

As SSL/TLS certificates enable encryption, they are integral to Hyper Text Transfer Protocol Secure(HTTPS), a protocol that encrypts all communication exchanged between a website and your browser.

• HTTPS starts when a browser requests a secure page.
• The web server responds with its public key and its certificate.
• The browser then verifies a trusted authority or CA issued this digital file.
• Assuming that's the case, the browser uses the web server's public key to encrypt a random symmetric encryption key and sends it to the server with an encrypted URL and other encrypted HTTP data.
• If the public key is valid, the web server uses its private key to decrypt the symmetric encryption key, URL, and HTTP data before sending over the HTML document and HTTP data now encrypted with the symmetric key.
• This symmetric key, in turn, allows the browser to decrypt the HTTP data and display it to the user.