User Guide

10.4.0
- 10.5.3
- 10.5.0
- 10.2.3
- 10.2.2 HotFix 1
- 10.2.2
- 10.2.1
- 10.2

Back Next

SSL Handshake Process

A SSL session always begins with an exchange of messages called the SSL handshake. The handshake allows the server to authenticate itself to the client by using public-key techniques, and then allows the client and the server to cooperate in the creation of symmetric keys used for encryption and decryption of the data. Optionally, the handshake also allows the client to authenticate itself to the server.

The following steps outline the handshake process:

The client sends the server its cipher settings (cryptographic algorithms and key sizes) and other information that the server needs to communicate with the client using SSL.

The server sends the client its cipher settings and other information. The server also sends its own certificate and may optionally request the client's certificate.

The client uses the certificate sent by the server to authenticate the server. If the server can be successfully authenticated, the client proceeds to step 4.

Using all data generated in the handshake thus far, the client will create a pre-master secret key for the session. The client encrypts with the server's public key (obtained from the server's certificate, sent in step 2), and then sends the encrypted pre-master secret key to the server.

If the server has requested client authentication, the client also signs another piece of data that is unique to this handshake and known by both the client and server. In this case, the client sends both the signed data and the client's own certificate to the server along with the encrypted pre-master secret key.

If the server has requested client authentication, the server attempts to authenticate the client. If the client can be successfully authenticated, the server uses its private key to decrypt the pre-master secret key, and then performs a series of steps (which the client also performs, starting from the same pre-master secret key) to generate the master secret key.

Both the client and the server use the master secret key to generate the session keys, which are symmetric keys used to encrypt and decrypt information exchanged during the SSL session and to verify its integrity.

The client sends a message to the server informing it that future messages from the client will be encrypted with the session key. It then sends a separate (encrypted) message indicating that the client portion of the handshake is finished.

The server sends a message to the client informing it that future messages from the server will be encrypted with the session key. It then sends a separate (encrypted) message indicating that the server portion of the handshake is finished.

The SSL handshake is now complete and the session begins. The client and the server use the session keys to encrypt and decrypt the data they send to each other.

Rename Saved Search

Table of Contents

User Guide

User Guide

SSL Handshake Process

SSL Handshake Process