SSL for Dummies

I don't mean you are dummy... Just seemed like a catchy title. Besides, most of us are dummies when it comes to SSL.

SSL is one of those words that we hear being thrown around to imply security. You can identify a site with an SSL certificate because the website address starts with https and has a green padlock.

While it is just one of the many steps to keep a site secure, it is a fundamental one but what exactly is it?

What is SSL?

SSL is short for Secure Sockets Layer and refers to the technology that ensures that communication between a client (such as your laptop) and a server (such as where your website is hosted) is encrypted. This is to help protect you from what so-called Man in the Middle Attack (MITM). In this kind of attack, the attacker (for a lack of a better word) can see the communication between a client and a server and intercept this communication. This is definitely a big problem because the attacker can see your login details and other important information that should normally be known only to you.

It helps to ensure that the communication between the server and the client is understood only by the two of them. If anyone intercepts the communication, it is complete gibberish. So, imagine two people who are the only living souls that understand an ancient and complicated language talking in a crowded room. No matter how many people listen, they only hear blah blah blah.

How does it work?

Good question. When a browser first initiates a connection with a website that has SSL, it establishes a secure connection using an SSL handshake. There are three keys required to set up this secure connection - private, public and session keys.

Here is a description of what happens during the SSL handshake;

1. The browser connects to the web server (website), asking the web server to identify itself
2. The web server sends a copy of its SSL Certificate and includes its public key.
3. The browser checks the certificate root against a list of trusted Certificate Authorities (CAs) and confirms that the certificate is valid and that its common name is valid for... Read more on https://tobaniyi.ng/ssl/