How do browsers handle SSL certificates?

L_K

I'm wondering how browsers handle SSL certificatecontent transmitted from a web server?

I know RSA algorithmit's important here, but why are we using it SHA-1here too? and what does it do SHA-1 algorithm?

Can someone explain the process to me in detail?

Michał Komorowski

The first question is how browsers use SHA-1 in the context of SSL. The full answer can be found here . The short answer is that SHA-1 is used to confirm that the certificate presented as proof is the same as the one signed by the CA.

Regarding the second question ( but what if a man-in-the-middle attack replaces the entire data including the certificate, and provides a signed SHA-1? ). The word "signature" is the key here. Man-in-the-middle can replace certificates. However, this certificate will not be trusted by browsers because it will not be signed by a certificate authority. An attacker cannot generate a certificate signed by a CA because he/she does not know the CA's private key.

Related

How do browsers handle SSL certificates?

L_K I'm wondering how browsers handle SSL certificatecontent transmitted from a web server? I know RSA algorithmit's important here, but why are we using it SHA-1here too? and what does it do SHA-1 algorithm? Can someone explain the process to me in detail? Mi

How do browsers handle SSL certificates?

L_K I'm wondering how browsers handle SSL certificatecontent transmitted from a web server? I know RSA algorithmit's important here, but why are we using it SHA-1here too? and what does it do SHA-1 algorithm? Can someone explain the process to me in detail? Mi

Do browsers trust wildcard SSL certificates?

Paul J I've set up a development server where I need to test a lot of LAMP sites. Their domain names are in the following format: https://webapp1.test.example.com https://anotherwebapp.test.example.com https://anotherclientssite.test.example.com I want to get

Do web browsers cache SSL certificates?

Lorin Hochstein Do any web browsers cache SSL server certificates? For example, if I change the SSL certificate on the web server, when all web browsers connect via SSL, will all browsers choose the new certificate, or maybe they have expired certificates? I'm

Do web browsers cache SSL certificates?

Lorin Hochstein Do any web browsers cache SSL server certificates? For example, if I change the SSL certificate on the web server, when all web browsers connect via SSL, will all browsers choose the new certificate, or maybe they have expired certificates? I'm

Do web browsers cache SSL certificates?

Lorin Hochstein Do any web browsers cache SSL server certificates? For example, if I change the SSL certificate on the web server, when all web browsers connect via SSL, will all browsers choose the new certificate, or maybe they have expired certificates? I'm

How do CXF bus and STSClient handle SSL certificates and proxies?

Jason I'm using CXF 3.1.5, how do I apply proxy settings and trust or ignore SSL certificates when sending requests ? I use CXF in the following two ways . Use org.apache.cxf.bus to get WSDL definitions from IdP or SP bus.getExtension(WSDLManager.class).getDef

How SSL and Certificates Work Between Servers and Browsers

Thomas I don't know much about how SSL and certificates work between server and browser. So I wrote something from this site http://www.tldp.org/HOWTO/SSL-Certificates-HOWTO/x64.html , whatever they say I don't quite know they said 1) A browser requests a secu

How to handle invalid SSL certificates with Apache HttpClient?

Rauch: I know, there are many different questions and many answers about this...but I don't get it... I have: installed ubuntu-9.10-desktop-amd64 + NetBeans6.7.1 "as is" from shutdown. Represents that I need to connect to a site via HTTPS. For this I use Apach

How to handle invalid SSL certificates with Apache HttpClient?

Rauch: I know, there are many different questions and many answers about this...but I don't get it... I have: installed ubuntu-9.10-desktop-amd64 + NetBeans6.7.1 "as is" from shutdown. Represents that I need to connect to a site via HTTPS. For this I use Apach

How to handle invalid SSL certificates with Apache HttpClient?

Rauch: I know, there are many different questions and many answers about this...but I don't get it... I have: installed ubuntu-9.10-desktop-amd64 + NetBeans6.7.1 "as is" from shutdown. Represents that I need to connect to a site via HTTPS. For this I use Apach

How do browsers handle cookies?

Diptopol Dam: How do browsers manage cookies? I mean, do I have to create a Cookie object? Motivation: I want to log in to a cookie site. These days, cookies are not just names and values - they also contain domains, expiration dates, etc. I need an answer in

How do browsers handle "<" in HTML?

Western letter In the following snippet, < renders as expected in Firefox 37.0.2, and I see the same in many other modern browsers. Is this textarea specification valid HTML5? Ideally should not &; by escaping "<" <html> <textarea> Hello World < </textarea> </

How do browsers handle exceptions?

MaximPro I decided to figure out how browsers handle scripts with only one line of code, and this line is an exception. Suppose we have this exception: throw Error("custom error"); According to the specification ecma262, ThrowStatement returns a completion re

How do browsers handle cookies?

Diptopol Dam: How do browsers manage cookies? I mean, do I have to create a Cookie object? Motivation: I want to log in to a cookie site. These days, cookies are not just names and values - they also contain domains, expiration dates, etc. I need an answer in

How do browsers handle exceptions?

MaximPro I decided to figure out how browsers handle scripts with only one line of code, and this line is an exception. Suppose we have this exception: throw Error("custom error"); According to the specification ecma262, ThrowStatement returns a completion re

How do browsers handle "<" in HTML?

Western letter In the following snippet, < renders as expected in Firefox 37.0.2, and I see the same in many other modern browsers. Is this textarea specification valid HTML5? Ideally should not &; by escaping "<" <html> <textarea> Hello World < </textarea> </

How do browsers handle "<" in HTML?

Western letter In the following snippet, < renders as expected in Firefox 37.0.2, and I see the same in many other modern browsers. Is this textarea specification valid HTML5? Ideally should not &; by escaping "<" <html> <textarea> Hello World < </textarea> </

How do browsers handle exceptions?

MaximPro I decided to figure out how browsers handle scripts with only one line of code, and this line is an exception. Suppose we have this exception: throw Error("custom error"); According to the specification ecma262, ThrowStatement returns a completion re

How do browsers handle cookies?

Diptopol Dam: How do browsers manage cookies? I mean, do I have to create a Cookie object? Motivation: I want to log in to a cookie site. These days, cookies are not just names and values - they also contain domains, expiration dates, etc. I need an answer in

How do browsers handle exceptions?

MaximPro I decided to figure out how browsers handle scripts with only one line of code, and this line is an exception. Suppose we have this exception: throw Error("custom error"); According to the specification ecma262, ThrowStatement returns a completion re

How do browsers handle exceptions?

MaximPro I decided to figure out how browsers handle scripts with only one line of code, and this line is an exception. Suppose we have this exception: throw Error("custom error"); According to the specification ecma262, ThrowStatement returns a completion re

How do browsers handle "<" in HTML?

Western letter In the following snippet, < renders as expected in Firefox 37.0.2, and I see the same in many other modern browsers. Is this textarea specification valid HTML5? Ideally should not &; by escaping "<" <html> <textarea> Hello World < </textarea> </

How do browsers handle expired cookies?

CodeMonkey1313 How do browsers handle expired cookies? I know the app doesn't read them in, and I'm assuming the browser doesn't send them, but are they regularly flushed from the filesystem? Rahul Taken from MSDN If the cookie has expired, the browser will no