RE: FN-FORUM: SSL and certificates

date posted 3rd August 2003 23:54

> ========================
> Saturday 2nd August 2003 14:41:26
> Re: FN-FORUM: SSL and certificates - Manjit Singh
> [EMAIL REMOVED]
>
> Amazon does not appear to use CA's, no detering messages
> there. What's
> the score here?
>

Amazon's certificate *is* signed by Verisign - for some reason clicking
IE's padlock doesn't give you this data - NS7 does.

Are you clear on what a certificate does? What it isn't is a seal of
approval for a business!

Basically SSL uses public key encryption to ensure no-one can eavesdrop
on (or change) data going between server and browser. One way to thwart
this would be to have a "man-in-the-middle" device (like a proxy server)
that does the following:
- user accesses https://www.barclays.com
- the proxy takes the request, reads the page from the real
www.barclays.com and serves it up - decrypting and recrypting the data
as it passes through.
- thus the user thinks they have a secure connection
- but the operator of the proxy can read anything!

To prevent this, SSL signs part of the transaction using the server
certificate. This allows the browser to validate that www.barclays.com
is the real McCoy. If this fails, you get the "scary message"!

So any browser has no way of knowing the difference between a
"self-signed" cert and a random cert from a "man-in-the-middle". Hence
they are only really a test tool.

For a CA to operate, it needs to have a reference to its root
certificate in MS browser (really OS) code. (and Netscape, Opera, etc).
Only a few firms have this exalted status - hence their fairly high
prices.

The alternative to having your own SSL site for card transactions is a
third party site (like Paypal or whatever). Here the shop will transfer
to the payment site - the user then transacts with the payment site,
which notifies the shop that they have paid. Typically you as a shop
don't get to see how - you just get the money less a service charge.

Hope this helps,
Richard