A picture to read HTTPS

This paper takes the bank digital certificate as an example

1. The bank must first create a digital certificate, which contains information about what encryption algorithm, public key, publisher, expiration date, and other attributes are used in the certificate, and then submits the digital certificate to the authoritative CA institution for signing. Why do I need a CA signature? Because only the authoritative CA authentication signature is credible Ah, you yourself signed, neither guarantee nor credible. and the authority of the CA is innate, it does not need to re-certification, whether it is a browser or JDK, the root certificate about the CA is the default, and will be loaded directly when used.

2. The CA Returns the signed certified digital certificate to the bank, which has more than one CA's digital signature, so that the CA assumes the responsibility of a risk guarantee, of course, in order to obtain this signing certificate, the Bank will need to provide a signature fee to the CA, similar to insurance. After the bank receives the digital certificate signed by the CA, it is stored in the local keystore along with the private key corresponding to the certificate.

After the bank is ready to work, it will be possible to configure the server to support SSL/TLS protocol access, such as HTTPS, and then silently wait for the client to receive service requests.

The next step is the entire process of an HTTPS transaction between the client and the bank:

3. The client initiates a service request beginning with HTTPS and tells the bank that I can access you using the HTTPS protocol.

4. after the bank receives the service request, takes out the server-side certificate in the KeyStore, then tells the client, you take it, and see my digital certificate terms you do not recognize?

5. the client receives the digital certificate sent by the bank look, yes, and the digital signature of the CA, on the tall Ah! No, I'm going to have to check the certificate. is the signature reliable or false? The client then sends this certificate to the CA for verification of the digital signature.

6. CA to the client sent over the digital certificate after a look, Yue Heyue, tell the client, yes, this digital certificate is my signature, no problem, no problem.

Further down, the client and the bank began a more in-depth discussion of the details of the SSL/TLS protocol, such as what is the symmetric encryption algorithm used in this session, and what kind of common key is used when the encrypted channel is built! This process is more complicated! @#￥%......&* (), one or two sentence is not clear, the general people do not need to understand, as early as the Daniel has packaged it well.

As long as we know, finally they agreed, both sides agree to adopt the same key, using symmetric encryption algorithm to the communication tunnel transmission data encryption and decryption operations.

In addition, each session of the obtained, for symmetric encryption algorithm common key is also different, randomly generated, to ensure the data security, the bank data can be the account information, that is money!

A picture to read HTTPS