HTTPS and SSL learning notes (ii)

This article describes the information about the certificate, refer to the article link http://www.guokr.com/post/116169/

I. Type of certificate

Several commonly used certificates are as follows:

(1) SSL Certificate for encrypting HTTP

(2) Code signing certificate for signing binaries, such as Windows kernel drivers, Firefox plugins, Java code signing, and so on.

(3) Client certificates, such as for encrypting messages, etc.

(4) Double factor certificate, the Net Silver Professional Edition uses the USB key inside is this kind of certificate.

The format of the certificate is defined by the standard.

These certificates need to be issued by a certified certification authority (often referred to as the CA authority) and the certificates issued by the CA are trusted. Businesses and individuals can apply for a certificate, depending on the type of certificate and the time factor. The charges are not the same.

Ii. requesting a certificate from a CA

The general Enterprise's certificate is higher than the individual's expense, the application certificate time is has the validity period, after the validity period has expired, needs to re-apply.

When you apply for a certificate, you need to provide the domain name of the website and provide the domain name to prove that the applicant has ownership of the domain name. In general, a certificate can only be bound to a domain name, only when the domain name is accessed, the certificate is trusted. In addition, the domain name can be a wildcard *, but such a certificate is more expensive. Baidu's certificate is a wildcard (1). The common name issued is the domain name that is filled in when the certificate is applied, and the issuer's common name is the issuing authority. If there is "Extended Validation SSL" in the word, indicating that the certificate is an EV SSL certificate (extended authentication SSL certificate), EV SSL certificate has a feature is to make the browser's address bar green, and also show the name of the company that the certificate belongs to. Two times in the validity period are the certificate effective time and the actual time. When you apply for a certificate, you will need to provide a business license and identity information in addition to the domain name.

Figure 1

Third, the verification process of the certificate

The certificate is organized in the form of a certificate chain, where the certificate is issued with a root certificate issued by the root CA authority, a certificate issued by the root CA authority, and an SSL certificate issued by the intermediate CA authority. When verifying a certificate is also a first-level authentication, only all certificates are trustworthy, this SSL certificate will be trusted by the browser. If the root certificate is untrusted, all of the certificates issued below are untrusted. Shows the certificate path:

Iv. Several reasons why the certificate is not trusted by the browser

(1) Expired certificate

(2) The domain name in the certificate is inconsistent with the domain name accessed

(3) The authority is not trusted

HTTPS and SSL learning notes (ii)