Secure Socket Layer in .NET

• Certificate Name, organization and address
• Serial Number
• Validate date of Certificate
• Holder Public key
• Signature Algorithms
• Expiry date
• Thumbprints

There are a few CA such as VeriSign, Thawte, DigiCert and Commodo that issue digital certificates in exchange for money. If you don't want to purchase a certificate from a CA, you can even generate your own self-signed certificate. We can even create a certificate, but browsers only trust certificates that come from an organization on their list of trusted CAs because browsers come with a pre-installed list of trusted CAs, referred to as the Trusted Root CA store. An organization must comply with security and authentication standards established by the browsers to be added to the Trusted Root CA store. You can have a look at the locally installed certificates via this command or MMC as in the following:

netsh http show sslcert



How SSL works

A SSL implementation requires a web server accompanied with the SSL features and a browser. One of the most important points to remember is that SSL only imparts security for the connection (communication medium between server and client) but does not indeed, offer security for the data once received. This means data are encrypted while being transmitted, but doesn't protect the data after being received. SSL uses public key encryption and provides data encoding, message integrity and server and client authentication.

When a client accesses a website it typically may contain both secured and public segments. The secure portion mandates the user to be authenticated in some fashion. When the client goes from a public page to a secure portion, the web server starts SSL and protects this type of communication.



The server then sends a message back to the client, indicating a secure session is established and the client in response sends its security parameters. The server compares those values to its own until it finds a match. The server authenticates to the client by sending it a digital certificate and if the client decides to trust the server, the process continues otherwise it is terminated and finally a secure communication medium is established.

In some rare conditions, the server can require the client to send over a digital certificate for mutual authentication. The client generates a session key and encrypts it with the server public key and is sent across to the server and now a genuine secure channel is established where both ends use that symmetric key to encrypt data back and forth.

Note: The session ends when the client sends a FIN packet to the server.

The following diagram is showing the comprehensive process of mutual authentication of both a server and client to each other in a Secure Socket Layer.



The asymmetric encryption is the basic building block of SSL where the public key is freely distributed to encrypt the message that can only be decrypted by the corresponding private key. The Secure Socket Layer employees a third-party organization, a Certificate Authority (CA), to identify one end or both ends of the transactions. This is in short how it works as in the previous diagram.

1. A browser sends a request to connect to the server and asks for a secure page (usually a document).
2. The web server sends its public key with its signing certificate back to the client.
3. The browser checks whether the certificate was issued by a CA it trusts. The client compares the information in the certificate with the information received from the website and verifies all the details. If so, the browser shows the purity of the server certificate by showing a green padlock and the client proceeds.
4. The browser generates a random symmetric encryption key and then encrypts it to the public key of the server. Finally it sends it to the server along with the encrypted URL and other encrypted HTTP data.
5. The web server decrypts the incoming packet using its private key and uses the symmetric key to decrypt the URL and HTTP data that was generated randomly at the client side.
6. Then the requested document from the client, along with other data encrypted with the symmetric key, is sent back to the browser.
7. Finally, the browser decrypts the packet using the symmetric key and secure handshaking is established.

SSL Advantage

SSL collectively offers subsequent advantages as used in modern e-Commerce scenarios.

• Secure online banking transactions, hide credit card details.
• Secure system and website logins credentials along with other online exchanged sensitive information.
• Secure the transfer of files over HTTPS and FTP(S) services.
• To secure hosting Control Panel logins and activity like cPanel and Parallels.
• Secure private network (intranet) based data traffic such as file sharing and database connections.
• Secure network logins and other network traffic with SSL VPNs.
• Secure webmail and applications like Exchange server, Office Communications Server and Outlook.
• Secure virtualization applications like cloud-based computing platforms.

Final Note

This article provided the internals of the Secure Socket Layer under .NET prospectus. It describes the algorithm used to encrypted communication over the wire and the role of public key / private key combinations in terms of securing sensitive data that is transmited across the network. More interestingly, it explains how SSL works and the importance of SSL certificates that are issued from a trusted CA and assists to prove the genuine identity of a website. Finally, we have come to an understanding of various advantages of implementing a SSL on a website.