Your secure server provides security using a combination of the
Secure Sockets Layer (SSL) protocol and (in most cases) a digital
certificate from a Certificate Authority (CA). SSL handles the
encrypted communications as well as the mutual authentication
between browsers and your secure server. The CA-approved digital
certificate provides authentication for your secure server (the CA
puts its reputation behind its certification of your organization's
identity). When your browser is communicating using SSL encryption,
the https:// prefix is used at
the beginning of the Uniform Resource Locator (URL) in the
navigation bar.
Encryption depends upon the use of keys (think of them as secret
encoder/decoder rings in data format). In conventional or symmetric
cryptography, both ends of the transaction have the same key, which
they use to decode each other's transmissions. In public or
asymmetric cryptography, two keys co-exist: a public key and a
private key. A person or an organization keeps their private key a
secret and publishes their public key. Data encoded with the public
key can only be decoded with the private key; data encoded with the
private key can only be decoded with the public key.
To set up your secure server, use public cryptography to create
a public and private key pair. In most cases, you send your
certificate request (including your public key), proof of your
company's identity, and payment to a CA. The CA verifies the
certificate request and your identity, and then sends back a
certificate for your secure server.
A secure server uses a certificate to identify itself to Web
browsers. You can generate your own certificate (called a
"self-signed" certificate), or you can get a certificate from a CA.
A certificate from a reputable CA guarantees that a website is
associated with a particular company or organization.
Alternatively, you can create your own self-signed certificate.
Note, however, that self-signed certificates should not be used in
most production environments. Self-signed certificates are not
automatically accepted by a user's browser — users are
prompted by the browser to accept the certificate and create the
secure connection. Refer to Section 26.5 Types of
Certificates for more information on the differences
between self-signed and CA-signed certificates.
Once you have a self-signed certificate or a signed certificate
from the CA of your choice, you must install it on your secure
server.
