SSL/TLS — How does it work?

Encryption of data at rest as well as in transit is one of the most important aspects for building secure web applications. This article is about the data encryption in transit for web applications. The most widely accepted and used encryption protocols is SSL and TLS.

What are SSL And TLS?
SSL stands for Secure Socket Layer. It is used to keep the communication between two systems secure on the internet by establishing a secure connection between them. This is done by encrypting the data being transferred between the systems.

TLS stands for Transport Security Layer. It is just the more secure and latest version of SSL.

How SSL Works?
SSL encrypts data using 2 types of cryptography techniques:

Asymmetrical Cryptography
This is the safest method of encryption. It requires 2 cryptographic keys — Public and Private Key. The public key is used to encrypt data and only someone who has the private key can decrypt that data. The server keeps the private key to itself and expects the public key to be distributed over the internet for encryption. This way any client that wants to send data to the server can encrypt it using the public key and only the server with private key has the ability to access it.

Symmetrical Cryptography
While Asymmetrical cryptography is the safest option, it is still not feasible to to keep using it for each data packet being transferred over the network because of it is resource intensive. SSL/TLS uses symmetrical cryptography by using single shared session key on both client and server once a communication session is established. But the single shared session key is generated for the first time when the SSL connection is established using the Asymmetrical Cryptography. If the SSL connection is broken somehow and a new connection is to be established, then the single shared session key will be generated again using Asymmetrical Cryptography.

The SSL Handshake and SSL Certificates

SSL handshake is the process of establishing a SSL connection between the client and server. Above diagram also depicts the same. It involves:

1. Client sending request to the server for establishing a secure connection.
2. The server responds with the public SSL certificate that it uses. An SSL certificate is a 3rd party issued digital certificates that is used to maintain the server authenticity and contains the public key of the server.
3. The client compares that against the certificate authorities that it supports and checks the integrity of the certificate with the domain name.
4. The client then generates a symmetric key of the server and sends encrypted version of it to the server using its public key.
5. The server then uses the private key to decrypt and gain the real symmetric key and uses it with the client for further communication.

This way the handshake process uses Symmetric and Asymmetric encryption to establish a secure connection between the client and server.

If you enjoyed this article, please click the 👏 button and share to help others find it! Feel free to leave a comment below.