SSLv3

[dkoksal]

Selamlar,
Bu ne anlama gelir üstatlar, SSL sertifikaları bir miktar sıkıntı mı çıkartacak?


It sounds as if the vendor is requiring SSLv3.

First, imagine a simple HTTPS connection between a browser and server. A user in a browser types in the URL of a website beginning with https and the brower makes the request. Lets assume that the server is using SSLv2. The request gets to the server and it replies with a message header stating it supports SSLv2 and sends its certificate. The browser receives the SSL certificate, inspects it, and negotiates the session key to be used. The handshake part of the session key negotiation is done with asymmetric cryptography, and when a session key is agreed on by the browser and the client they switch to symmetric cryptography while using the session key, because symmetric key crypto is faster than assymetric. Anyway, the SSLv2 handshake does not require that the browser send its own certificate back to the server. In SSLv2 only the server has to prove its identity to the client, the browser.

However, in SSLv3 not only does the server have to prove its identity to the client, but the client or browser also has to identify itself to to the server.and it does that by sending its own certificate. So there are two certifcates involved in SSLv3, one on the server and one on the client.