Secure Sockets Layer (SSL)

As shown here, the lock icon shows that your connection to the site is secured via SSL. The "info" icon beside the lock can show you the details of the certificate.

The concept of SSL is mainly useful for those Hosting their professional Webservers. For the users, it only matters if the connection is secure, The SSL certificate is provided to a website after its verification by the authorities. The site having SSL secures your data while it is being transmitted from your browser to its server. So, SSL is of huge importance.

What is SSL?

SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. SSL is an industry standard and is used by millions of websites in the protection of their online transactions with their customers.

SSL allows sensitive information such as credit card numbers, social security numbers, and login credentials to be transmitted securely. Normally, data sent between browsers and web servers is sent in plain text—leaving you vulnerable to eavesdropping. If an attacker is able to intercept all data being sent between a browser and a web server, they can see and use that information.

More specifically, SSL is a security protocol. Protocols describe how algorithms should be used. In this case, the SSL protocol determines variables of the encryption for both the link and the data being transmitted.

SSL Certificate 

You might have seen a warning from Chrome or any other browser that "Connection not secured" or "Security certificate expired". Here we add the site to exception list and proceed visiting the site.

To be able to create an SSL connection a web server requires an SSL Certificate. When you choose to activate SSL on your web server you will be prompted to complete a number of questions about the identity of your website and your company. Your web server then creates two cryptographic keys - a Private Key and a Public Key.

The Public Key does not need to be secret and is placed into a Certificate Signing Request (CSR) - a data file also containing your details. You should then submit the CSR. During the SSL Certificate application process, the Certification Authority will validate your details and issue an SSL Certificate containing your details and allowing you to use SSL. Your web server will match your issued SSL Certificate to your Private Key. Your web server will then be able to establish an encrypted link between the website and your customer's web browser.

The complexities of the SSL protocol remain invisible to your customers. Instead their browsers provide them with a key indicator to let them know they are currently protected by an SSL encrypted session - the lock icon, clicking on the lock icon displays your SSL Certificate and the details about it. All SSL Certificates are issued to either companies or legally accountable individuals.

Typically an SSL Certificate will contain your domain name, your company name, your address, your city, your state and your country. It will also contain the expiration date of the Certificate and details of the Certification Authority responsible for the issuance of the Certificate. When a browser connects to a secure site it will retrieve the site's SSL Certificate and check that it has not expired, it has been issued by a Certification Authority the browser trusts, and that it is being used by the website for which it has been issued. If it fails on any one of these checks the browser will display a warning to the end user letting them know that the site is not secured by SSL.

How the SSL (encryption) works?

There are two different keys associated with an SSL certificate - Public key and Private key. Public key, as the name suggests, need not to be hidden while the private key remain hidden with the Server only.

When we establish a connection with an SSL secured web-server, its SSL certificate information is acquired by our web-browser. Along with the information, our browser will also get a public key. The data or request we send from our browser, is encrypted with the help of public key and has the capacity of only being opened by the private key linked to that particular SSL certificate.

Now if anyone get connection in between our browser and server (man-in-the-middle), he/she may get the data which is encrypted. He/she can't decrypt that data as they don't have access to private key. Hence, the user details are protected.

When the encrypted data reaches the server, the server with the help of private key, decrypts that data and the original information is retrieved.