Information security on the web is one of the main issues that site owners need to pay close attention to. In the fast growing world of cyber threats, they must clearly understand how to prevent data leakage or protect their resources from third party access to them.
The installation of SSL certificates has become a modern standard for site security. However, such a protection mechanism is relatively new and difficult for the mass user. Let’s try to understand what this technology is and how it guarantees the security of information on web resources.
What is an SSL certificate?
Before proceeding to the point on why the site needs an SSL certificate, it is worth noting the very concept of the SSL protocol. It is a cryptographic protocol that provides reliable data transmission over the network. It is the guarantee of a secure connection between the user’s browser and the resource.
HTTP vs HTTPS
HTTPS has significantly improved the security of HTTP data. If SSL is installed on the site, then all data is transmitted via HTTPS – a secure version of the HTTP protocol. It encrypts user data and forwards it to the site owner via the TCP transport protocol. In other words, all information transmitted by the user is hidden through encryption to third parties: operators, Wi-Fi administrators and providers.
How the SSL protocol works
As you know, the basis of all coding methods is a key that helps to encode or read information. The SSL protocol uses an asymmetric cipher with two types of keys:
- Publish . This is actually an SSL certificate. It encrypts data and is used to transmit user information to the server. For example, a visitor enters his credit card number on the site and clicks on the “Pay” button.
- Private . Required to decode the message on the server. It is not transmitted together with the information, as in the case of the public key, and always remains on the server.
In order for a site to manage these connections, its owner needs an SSL certificate. It is a kind of digital signature, which is individual for each platform.
What’s inside an SSL certificate
An SSL certificate can contain the following important information:
- domain of the site on which the certificate is installed;
- company owner name;
- country, city of registration of the company;
- period of validity of the SSL certificate;
- Information on the Certification Authority;
- Serial number of the SSL certificate;
- SAN articles (multi-domain SSL);
- Trusted and untrusted certificates.
The main source of SSL certificates are the trusted certification authorities or the certification authorities (CA). These are organizations that have undeniable authority in the IT services market and use the well-known public cryptographic key. In browsers, their list is usually found in the ” Trusted Root Certification Authorities ” section.
A digital signature certified by a certificate from this center is proof of the authenticity of the company that owns the domain name and determines the owner’s right to legally use the secret key, it is called ” Trusted “.