Why Certificates Are Not Secrets for SSL Authentication


qweruiop

I'm reading about certificate based authentication in SSL and have a question about the process. (Picture was taken from the link above)

enter image description here

The question is: why server.cerand client.cernot a secret. In this diagram, it appears that the communication is not encrypted when the certificates are exchanged, does this mean that both certificates are exposed in clear text? If so, why is it safe? Because in this way, an adversary can easily obtain the server's public key and its certificate, and impersonate the server. I think I misunderstood something. Please correct me.

username

Because in this way, an adversary can easily obtain the server's public key and its certificate

correct.

and mock the server.

Incorrect You need the private key as well as the certificate to impersonate the server.

The diagram you quoted is incorrect. Both parties will have not only the keystore, but also the truststore. Incoming certificates are checked against the local truststore; outgoing certificates are from the keystore.

The given certificate is used to verify that the public key belongs to the server

no. The certificate and its digital signature are used to verify that the certificate belongs to the server. Digital signatures are created using a private key. See the article you cite.

However, this is not entirely true. In this diagram, incoming certificates are checked against a local truststore , which is separate from the keystore . Session keys are never exchanged (2.1 step 5).

Related


Why Certificates Are Not Secrets for SSL Authentication

qweruiop I'm reading about certificate based authentication in SSL and have a question about the process. (Picture was taken from the link above) The question is: why server.cerand client.cernot a secret. In this diagram, it appears that the communication is n

Why disable DNSSEC for SSL certificates?

Do not I want to know one thing about DNSSEC. If I have a domain that I want to get an SSL certificate for, why would they want me to disable DNSSEC in a service that uses Let's Encrypt to issue a certificate for the domain name? I've seen several help sites w

WCF authentication error with mutual SSL using certificates

yuri of angels I am trying to use a service published by another company. The specifications for authentication and communication are: Soap HTTPS with two-way SSL authentication (2-way SSL) Use the public certificate they sent us (which I use as ServiceCertifi

Why RDS doesn't use Amazon root certificates for SSL connections

pony According to RDS' documentation, a specific public certificate ("rds-ca-2019-root.pem") needs to be installed in order to use RDS with SSL. However, Amazon has a public certificate "Amazon Root CA" which is installed on most operating systems. Is there an

Java and SSL certificates

Andy: I'm trying to use Secure Sockets Layer (HTTPS) to connect to a PHP script in Java, but I've found that for maximum security/validity I have to import the SSL certificate used by the website into my application. ..I do not know what to do. If it helps, my

Where are SSL certificates stored?

iOS Monkey I understand how SSL works, but my question is more about the storage of certificates on the client side. To understand the exact context, let's assume I'm writing my own browser. My rendering part will be done by WebKit and the HTTP request handlin

Where are SSL certificates stored?

iOS Monkey I understand how SSL works, but my question is more about the storage of certificates on the client side. To understand the exact context, let's assume I'm writing my own browser. My rendering part will be done by WebKit and the HTTP request handlin

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re

Java and SSL certificates

Andy: I'm trying to use Secure Sockets Layer (HTTPS) to connect to a PHP script in Java, but I've found that for maximum security/validity I have to import the SSL certificate used by the website into my application. ..I do not know what to do. If it helps, my

Pinning SSL certificates with libcurl

SP Miguel Jenner I wonder if this example is enough to provide a way to do certificate pinning with libcurl : http://curl.haxx.se/libcurl/c/cacertinmem.html Because I found out that curl also allows http://curl.haxx.se/libcurl/c/CURLOPT_PINNEDPUBLICKEY.html Si

Certificates returned by free SSL

O. Shekri Raz Today I installed a free ssl certificate on my website and it was easy, but I have some questions about it. FreeSSL returned three files: "private.key", "certificate.crt", "ca_bundle.crt". So there are my questions: 1) Who does this private key b

Where are SSL certificates stored?

iOS Monkey I understand how SSL works, but my question is more about the storage of certificates on the client side. To understand the exact context, let's assume I'm writing my own browser. My rendering part will be done by WebKit and the HTTP request handlin

SSL certificates and links

Eric Sometimes I use elink for web browsing and it happens that some HTTP sites fail to load due to it SSL error. An example is https://www.rust-lang.org , which doesn't load in elink but works fine on other browsers like Chrome and firefox. Checking the https

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re

SSL certificates break CSS

Sam Recently purchased an SSL certificate, but the site doesn't seem to be able to load the site CSS. Here is the link https://www.rentpayment.com/ By looking at the console error message this seems to be the problem: <link rel="stylesheet" href="http://www.re