SSL Certificates Explained: A Deep Dive into Encryption, Attacks, and How HTTPS Secures the Web 🔐

Source: Dev.to

Why SSL/TLS is Needed

When you open a website and see the 🔒 lock icon in your browser, you’re benefiting from SSL/TLS, one of the most important security technologies on the internet.

The early internet was designed to share information, not to protect it. Protocols like HTTP sent data in plain text:

POST /login HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded

username=jack&password=123456

Anyone on the same network (Wi‑Fi, ISP, router) could read this request, leading to:

• Data theft
• Account hijacking
• Identity fraud

Core problem: How can two parties communicate securely over an insecure network?

Symmetric Encryption

Symmetric encryption uses a single secret key for both encryption and decryption.

Plain Text ──(Secret Key)──► Encrypted Data
Encrypted Data ──(Same Secret Key)──► Plain Text

• Algorithms: AES, ChaCha20 (DES is now considered insecure)
• Characteristics: Simple math operations, very efficient for large data, used to encrypt actual website traffic.

Challenge: How do the client and server agree on the secret key? Sending the key over the internet would expose it to attackers, so symmetric encryption alone is insufficient.

Asymmetric Encryption

Asymmetric encryption uses a pair of keys:

• Public Key: Shared with everyone
• Private Key: Kept secret

Data encrypted with Public Key ──► Decrypted with Private Key

Anyone can encrypt data using the public key, but only the holder of the private key can decrypt it. This solves the secure key‑exchange problem.

• Algorithms: RSA, ECC (Elliptic Curve Cryptography)
• Characteristics: Secure key sharing but computationally expensive and slow, making it unsuitable for encrypting large amounts of data.

Combining Symmetric and Asymmetric: The SSL/TLS Handshake

SSL (now TLS) merges the speed of symmetric encryption with the secure key exchange of asymmetric encryption.

Handshake Overview

1. Client Hello – The browser sends:

   • Supported TLS versions
   • Supported cipher suites
   • A random number

2. Server Hello – The server replies with:

   • Its SSL certificate (containing the domain name, public key, CA signature, and expiry date)
   • Chosen cipher suite
   • Another random number

3. Verification – The browser:

   • Verifies the CA signature
   • Checks the domain name and expiration date
   • Blocks the connection if verification fails (preventing MITM attacks)

4. Key Exchange – The browser:

   • Generates a symmetric session key
   • Encrypts it with the server’s public key
   • Sends it to the server

5. Secure Communication – Both sides now share the same secret key and use fast symmetric encryption for all subsequent data.

SSL Certificate Essentials

An SSL certificate is a digitally signed document that includes:

Security Benefits of SSL/TLS

SSL/TLS provides:

• Encryption: Protects data in transit.
• Authentication: Verifies server identity, preventing impersonation.
• Integrity: Detects tampering of transmitted data.

These protections mitigate attacks such as:

• Man‑in‑the‑middle (MITM)
• Packet sniffing
• Credential theft
• Data tampering
• Session hijacking

Modern browsers reinforce security by:

• Marking HTTP as “Not Secure”
• Blocking insecure cookies
• Enforcing HTTPS for many APIs

Takeaway

SSL/TLS is more than just a certificate; it is a carefully designed system that:

• Solves key exchange securely
• Prevents impersonation of servers
• Protects data on hostile networks

Understanding how SSL/TLS works makes you a better backend engineer, ensuring that the services you build are secure by design.