SSL handshake between Client IE and the IIS server for a Server Certificate

  • Article

The client first authenticates the server using the
certificate. After authentication, the client uses public-key encryption to send
information that is used to created a shared key (the session key). Then the
session key is used to perform the more efficient symmetrical-key encryption on
the rest of the data. The shared key is specific to this session and is never
used again.

The SSL handshake is what brings
authentication, encryption, and verification together. The following occurs
during an SSL handshake:

  1. The client sends the server the client's SSL version number,
    cipher settings, randomly generated data, and other information that the server
    needs to communicate with the client using SSL.

  2. The server sends the client the server's SSL version number,
    cipher settings, randomly generated data, and other information the client needs
    to communicate with the server over SSL. The server also sends its own
    certificate.

  3. The client authenticates the server as described in the
    Certificate Authorities and Trusts section.

  4. With the information gathered so far, the client creates a
    premaster secret for the session, encrypts it with the server's public key, and
    sends it to the server.

  5. Using the premaster secret, the server follows a series of
    steps to create the master secret; this occurs on the client.

  6. The client and the server use the master secret to create
    the session keys.

  7. The client sends a message to the server stating that the
    next message will be encrypted with the session key.

  8. The client sends an encrypted message to the server stating
    that the handshake process is finished.

  9. The server sends a message to the client stating that the
    next message will be encrypted with the session key.

  10. The server sends an encrypted message to the client stating
    that the handshake process is finished.

  11. The process is now finished. The client and the server use
    the session keys to encrypt data with symmetric-key encryption.

 Hope this helps!