L20. How are certificates used to secure WWW?

Question 1

What is the purpose of certificates?

Answer 1

Certificates ensure that data transmitted between clients and servers is encrypted and that the entities involved in the communication are authenticated.

Question 2

How are certificates used to secure web communication?

Answer 2

Through the use of SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocols, which rely on digital certificates issued by trusted Certificate Authorities (CAs).

Question 3

What is a CA?

Answer 3

A Certificate Authority, a trusted entity that issues Secure Sockets Layer (SSL) certificates

Question 4

What is a certificate?

Answer 4

A digital certificate is an electronic document that uses a digital signature to bind a public key with an identity — information such as the name of a person or an organization, their address, and so on.

Question 5

How are certificates issued?

Answer 5

Certificates are issued by CAs, which verify the identity of the certificate holder before issuing the certificate.

Question 6

What do web browsers use certificates for?

Answer 6

Authenticating content sent from web servers, ensuring trust in content delivered online. When a web browser connects to a server, the server presents its digital certificate to the browser. This certificate contains the server’s public key and is signed by a CA.

Question 7

What is a PKI?

Answer 7

A public key infrastructure, a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption.

Question 8

How does a client check the validity of a certificate?

Answer 8

1. By ensuring it is signed by a trusted CA.
2. By verifying that the certificate has not expired.
3. By checking the certificate against the CRL to ensure it hasn’t been revoked.
4. By validating the domain name matches the certificate’s subject.

Question 9

What happens after the browser has validated the server’s certificate?

Answer 9

If the certificate is valid, the client trusts that the server is legitimate. The client then uses the server’s public key from the certificate to encrypt a randomly generated session key. This session key will be used for symmetric encryption during the communication session.

The server decrypts the session key using its private key. Both the client and server now share this session key, which is used to encrypt and decrypt data exchanged during the session. Symmetric encryption is preferred for the actual data transmission because it is faster than asymmetric encryption.

Question 10

Name three benefits of using certificates

Answer 10

1. Encryption: Certificates enable the use of strong encryption, which ensures that data transferred between the client and server remains confidential and cannot be intercepted or read by unauthorized parties.
2. Authentication: Certificates authenticate the identity of the server (and potentially the client, in mutual TLS), ensuring that users are communicating with the legitimate server rather than an imposter.
3. Integrity: Certificates and SSL/TLS protocols ensure data integrity. Data sent over an encrypted connection cannot be altered without detection, as the encryption algorithms include mechanisms to verify that the data has not been tampered with.