:What is an SSL certificate?

Implementation

SSL certificate-based encryption

SSL implements secure communication based on a hybrid mechanism of asymmetric encryption for authentication and symmetric encryption for data transmission. The core process consists of two phases: certificate generation and verification and construction of an encrypted session.

1. Certificate generation and verification

   • When a server applies for a certificate from the CA, the server first generates a 2048-bit Rivest-Shamir-Adleman (RSA)-based or 256-bit elliptic curve cryptography (ECC)-based key pair. Then, the server packages the required information, including the public key, domain name, and enterprise information, into a certificate signing request (CSR).

   • After the CA approves the domain name ownership verification that uses the Domain Name System (DNS) verification or file verification method, the CA uses its own private key to digitally sign the server public key and generates a standard certificate. The signature helps generate a chain of trust in the following structure: root certificate, intermediate certificate, and server certificate. The browser verifies all certificates in the structure to prevent forgery.

2. Construction of an encrypted session

   • In a TLS handshake process, the client sends a ClientHello message to start the handshake process. The message includes the supported cipher suites and random numbers.

   • The server responds with a ServerHello message, selects cipher suites, and sends its certificate chain.

   • The client checks the validity of the certificate, including the domain name, validity period, and revocation status such as Online Certificate Status Protocol (OCSP).

   • The client generates a pre-master key, encrypts it with the public key of the server, and sends it to the server.

   • The client and server use the pre-master key and their random numbers to derive the session key through a key exchange mechanism, such as Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) or Diffie-Hellman Ephemeral (DHE).

   • Subsequent communications use symmetric encryption algorithms, such as Advanced Encryption Standard (AES), to improve performance and reduce computing overhead.

Scenarios and usage

A website that does not use an SSL certificate is not protected. All transmission data is in plaintext, and attackers can easily intercept sensitive information such as user passwords and bank card numbers through methods such as public Wi-Fi and network sniffing. For example, man-in-the-middle attack (MITM) attacks are launched against the e-commerce payment pages of an enterprise, resulting in theft of funds. The browser marks such websites as unsecure, which directly causes traffic loss. In addition, unencrypted communications may violate multiple global regulations, and the involved enterprises may face high fines and lose compliance qualifications in industries such as finance and healthcare.

If an SSL certificate is deployed, the secure channel built by the hybrid encryption mechanism is very difficult and time-consuming to crack even if data is intercepted, which requires a large amount of computing resources and time. After an SSL certificate is deployed, a lock icon is displayed in the address bar of your browser. If you deploy an extended validation (EV) certificate, the name of your enterprise is displayed in the address bar. This significantly improves user trust and the trust of the website. Legally, an SSL certificate meets the requirements of more than 20 international certifications, including Multi-Level Protection Scheme (MLPS) 2.0 and PCI-DSS. This avoids legal risks.

Procedure

Purchase

Alibaba Cloud supports domain validated (DV), organization validated (OV), and EV certificates. Alibaba Cloud also supports multiple trusted CAs, including DigiCert, GlobalSign, and GeoTrust. The CAs provide various types of certificates, including single-domain, wildcard, and multi-domain certificates. You can select a certificate brand and type based on your website security requirements. For more information about how to purchase certificates, see Purchase an official certificate.

Creation and application

The certificate application process consists of the following steps: creation, application, and domain name ownership verification.

• Creation

  After you purchase an official certificate, you need to bind a domain name to it. If you already bind a domain name when you purchase the certificate, skip this step. For more information, see Create a certificate.

• Application

  You must enter the required information based on the certificate type and submit the information to the CA for review. The required information includes the domain name or IP address that you want to bind to the certificate, the verification method of domain name ownership, the contact information of the certificate, and the business license of your company. For more information, see Apply for a certificate.

• Domain name ownership verification

  Before the CA issues the certificate for your website, you must cooperate with the CA to verify that you own or can manage the domain name bound to the certificate. For more information, see Domain name ownership verification.

Deployment

After a certificate is issued, you can deploy it to the server of your website to ensure HTTPS access to the website. The deployment process varies based on the server type and the hosting environment. Supported servers include Apache, NGINX, and IIS servers. For more information, see Deploy an SSL certificate.

Subsequent operations

Renewal

When a certificate is about to expire, you can renew it to obtain a new certificate and install the new certificate on the server of your website to ensure continuous encryption and security for the website. In most cases, a certificate is valid for up to 397 days, approximately 13 months. If you do not renew a certificate after it expires, security issues may occur and security alerts may be generated on browsers. This compromises user trust and experience. For more information, see Renew an official SSL certificate.

Revocation

If you no longer want to use a certificate due to security or other reasons, you can revoke it. After a certificate is revoked from the CA, you can no longer use the certificate for secure communications. For more information, see Revoke and delete a certificate.

Certificate brands and types

You can purchase SSL certificates of multiple brands and types from Alibaba Cloud Certificate Management Service. When you purchase a certificate, you must consider factors such as the deployment scenario, certificate type, security level, and price. For more information, see Select an SSL certificate.

Certificate brands

The following table describes the certificate brands that support SSL certificates.