Understanding SSL – Part 1: Certificates and Keys
Wednesday, October 14th, 2009The technology behind Secure Sockets Layer (SSL) network connections is often perceived as a bit of “black magic” – smoke and mirrors securing our Internet connections from snooping. When banking and shopping online, even a novice user understands their browser sets up an HTTPS connection (which is simply HTTP over SSL) to protect the transaction. It’s easy to simply surf to a secure URL and know that, somehow, SSL is magically keeping you safe.
Developing software that uses SSL is an entirely different matter. The simplicity quickly fades, and the developer must confront the complexities of certificate management, trust stores, handshaking, and a host of other details that must be perfectly aligned to make the secure communication work. In Part 1, we’ll cover a very high level of SSL concepts. In subsequent posts, we’ll take a deeper dive into making these connections happen in both Java and C#.