Secure Sockets Layer (SSL) and its successor, Transport Layer Security (TLS), are protocols used for securing the communication between web browsers and servers. The term "SSL" is commonly used to refer to both SSL and TLS even though the original SSL protocols were phased out and replaced with TLS.
The Purpose of SSL
The purpose of SSL is to establish a secure communication channel between a client, such as your web browser, and a server. This secure communication channel ensures two things:
- Your web browser can trust it is communicating with the web server it thinks it is.
- All communication between your web browser and the server is encrypted, so nobody else can read the communication.
The Purpose of SSL Certificates
When your browser initiates communication with a server over SSL, the first step is for your browser to make sure it's talking to the correct server. This step is critically important as it would defeat the entire purpose of SSL if your browser was having a private conversation with the wrong server or even an attacker.
Solving this problem of establishing trust is the purpose of SSL certificates. SSL certificates provide a way for your browser to know that a server really is who it says it is.
When your browser begins talking to a server over SSL, the first thing the server does is send your browser an SSL certificate that is cryptographically signed (cannot be forged) by an organization your browser already trusts. This certificate essentially says, "Until July 2017, you can trust this server is both example.com and www.example.com."
So, who are these organizations your browser already trusts? The answer is your browser or operating system comes with a built-in set of root certificates: SSL certificates belonging to well-known certificate authorities (CAs) your browser will always trust.
Putting this all together, when your browser receives an SSL certificate from a server, it does the following checks before considering the certificate valid:
- Is the certificate signed by one of the root certificates the browser trusts?
- Is the certificate trusted for the domain name that the browser is requesting?
- Is the certificate not expired?
If the certificate looks good to the browser, the browser is now ready to establish an encrypted connection with the server. Using public-key cryptography and the server's public key listed in the SSL certificate, your browser can now create a secure connection with the server over an untrusted network.
Why We Need Certificate Authorities
As mentioned earlier, your browser uses a chain of trust to know whether to trust an SSL certificate presented by a server. Your browser or operating system comes with a set of certificates that are the root of this chain of trust. The companies those root certificates belong to have a huge amount of responsibility: they need to make sure anyone who asks them to sign an SSL certificate for a particular domain name is really the owner of that domain.
These companies that own the root certificates your browser trusts are called certificate authorities (CAs). To get an SSL certificate for your domain signed by one of these CAs, you need to prove to the CA that you are the owner of your domain. There are a few ways to prove you own a domain, and some CAs now even offer APIs that can be used to automate the steps involved with proving ownership and obtaining certificates.
Ensuring you own a domain name before issuing an SSL certificate is a responsibility the CAs must take very seriously. If a CA doesn't do proper checking, it can put everyone online at risk since a malicious party could obtain SSL certificates for any domain and these certificates would be trusted by all browsers. If a CA doesn't do proper verification or has other security problems, browsers and operating systems may remove their root certificate, which can essentially put the CA out of business.
Digging Deeper
As you might imagine, we've simplified many concepts and skipped many details. If you'd like to learn more, take a look at the Wikipedia articles on certificate authorities (not too technical) and SSL/TLS (fairly technical).
Alert: For Control Panel Help & Tutorials, click here: Panel Tutorials
