SSL Concepts

Module Objective: After completing this module, the student will have a basic understanding of SSL.

Within the past two years, security on the Internet has been playing an ever-increasing role of importance. Browsing through a Web site such as CNN.com will reveal story after story of identity theft, credit card theft, and other types of theft via the Internet. All of these news stories have one common element--suggestions on how to combat this type of cyber theft. All these stories refer to Internet security as the solution.

SSL is a solution to battle these types of cyber theft. SSL is a security layer that exists between TCP/IP and application protocols such as HTTP, LDAP, FTP, and Telnet. The following figure illustrates SSL's place in the Internet community:

Figure 1: SSL Architecture.

In a typical Internet scenario, the browser will incorporate an SSL layer. This will allow data that is sent from the client to become encrypted before being sent to the network client. Once the data leaves the network client, it is converted to a network protocol (typically TCP/IP) and then sent through the Internet to the appropriate server. When the server receives the data, the server's SSL protocol layer decrypts the data and passes it to the proper server application for processing. When the server sends a reply back to the client the process is repeated - only in reverse.

SSL is most commonly used for transmitting sensitive information, such as credit card numbers and passwords, and as an authentication mechanism. SSL is the standard protocol in use today for secure communication over the Internet. SSL servers are typically used for Web hosts, while the SSL clients are typically Web browsers.

Note: The following link is not in the normal SSL course progression, but is provided as an informative way to learn and understand SSL packet exchange routines.

If you are interested in a play by play discussion about how information is transmitted during an SSL session, see How SSL Works.

During the labs of this course you will configure an SSL client and an SSL server. Additionally, you will write sections for both the SSL client and SSL server --effectively converting a Java sockets based client and server to use the SSL protocol.

Last updated on: