How SSL works tutorial - with HTTPS example
Why Stack Overflow recommends it
Stack Overflow users link it as a quick visual explanation of the SSL handshake and certificate encryption when answering questions about HTTPS, ajax and secure forms.
Recommended by 1 people across 1 different months, 2011 to 2014.
What it is
An 11-minute screencast from 2010 explaining how SSL/TLS works, walking through the handshake, certificates, key exchange and the master secret, with an HTTPS example. It also references a tutorial on setting up client certificate authentication on IIS.
What people said
Recommends Nishanth Nair · 2013-03 · Stack Overflow · on “Secure Socket Layer SDK”
SSL is enabled on the server not on the client. What SSL do is to encrypt traffic between a client and server. All clients with modern browsers or webkits are by default SSL compatible. To enable SSL, you need to buy an SSL certificate from a certificate issuing authority like Godaddy, Verisign etc. and install on your server. a certificate is a private public key pair which does public key encryption. Here is a good video explaining SSL. [this video] . So bottom line is that you don't have to worry about SSL on the client side. once you get your service or php link up and running using SSL, just access the url using https on your client side. It is no different than accessing it over http .
Cites Jorre · 2011-11 · Stack Overflow · on “SSL: can the secret key be sniffed before the actual encryption begins?”
I was looking into SSL and some of the steps that are involved to set up an encrypted connection between a server and a client computer. I understand that a server key and certificate is sent to the browser, and that a secret code is being calculated, like they say in the following video: [this video] around 5:22, they talk about a master secret code that is being calculated to start talking in an encrypted way. My question now is: before the connection is actually encrypted (the handshake phase), all communication between the server and the client can be sniffed by a packet sniffer. Isn't it then possible to sniff the encryption key or other data that is used to set up a secure connection?
Cites Fresheyeball · 2012-09 · Stack Overflow · on “jQuery ajax and SSL”
It does not have anything to do with SSL. Ajax posts have to originate somewhere, and so firebug will always be able to it in your browser (as its not encrypted within the browser instance itself). SSL encrypts the connection between your browser and the server, to prevent eves dropping. So that data will not be visible to other machines. If you want to see the data in its encrypted form I recommend setting up a debugging proxy [LINK] . See an explanation of ssl here [this video] .
Cites Chris Wesseling · 2014-04 · Stack Overflow · on “Certificate with Oauth API”
Presumption I take it this [LINK] is the "ready made PHP lib" you refer to? If you have a question on what some code does with some file, it's helpful to post a link to the code and even more helpful to post your breakdown of it. If you try to read the code, you'll get better Google terms, and clearer narrower more easily answered SO questions, that have a wider application for other future visitors: A question "What does some code do" is easier to answer and may be found by people in the future that search for the same function. SSL certificates It's hard to understand what some API code does with a certificate if we have no understanding of what certificates are for. So lets try to get ssl
Cites sfThomas · 2014-09 · Stack Overflow · on “Android - Best way to implement encrypted IM”
It is hard to say what is best, the solution also depends on how secure you want this to be. Fixed RSA keypair - you could generate an RSA keypair and use them to encrypt the traffic. This however will not protect the conversation from someone who decompiles your APK file and extracts the RSA keys - though you can try to make this hard by obfuscating your code and hiding the key by XORing it or using reflection to access it on your application. There are some relevant suggestions here [LINK] and questions/answers about implementation here [LINK] . Dynamic encryption keys with SSL - the encryption keys to use is negotiated for each client separately, on the fly. For this the clients need to t
Cites I wrestled a bear once. · 2014-10 · Stack Overflow · on “Secure contact form?”
"Security" is an extremely broad topic, but for starters you can secure the data being transferred by buying a (--or generating your own self-signed) SSL certificate. That will encrypt any data sent to your form. Whether or not you need the encryption depends on what kind of info you're asking for. If you're just asking for suggestions you probably don't need it to be too secure, but if you're requesting sensitive info like CC numbers or SSNs it's actually illegal not to have SSL (at least here in the states). [LINK] [this video] [LINK] [LINK]