Your secure Web server provides security using a combination of the Secure Sockets
Layer (SSL) protocol and (in most cases) a digital certificate from a
Certificate Authority (CA). SSL handles the encrypted communications
and the mutual authentication between browsers and your secure Web server. The
CA-approved digital certificate provides authentication for your secure Web server
(the CA puts its reputation behind its certification of your
organization's identity). When your browser is communicating using SSL
encryption, you will see the https:// prefix at the beginning of the
Uniform Resource Locator (URL) in the navigation bar.
Encryption depends upon the use of keys (think of them as secret
encoder/decoder rings in data format). In conventional or symmetric
cryptography, both ends of the transaction have the same key, which they
use to decode each other's transmissions. In public or asymmetric
cryptography, two keys co-exist: a public key and a private key. A
person or an organization keeps their private key a secret, and
publishes their public key. Data encoded with the public key can only
be decoded with the private key; data encoded with the private key can
only be decoded with the public key.
To set up your secure server, you will use public cryptography to create
a public and private key pair. In most cases, you will send your
certificate request (including your public key), proof of your company's
identity, and payment to a CA. The CA will verify the certificate
request and your identity, and then send back a certificate for your
secure Web server.
A secure server uses a certificate to identify itself to Web
browsers. You can generate your own certificate (called a "self-signed"
certificate) or you can get a certificate from a Certificate Authority
or CA. A certificate from a reputable CA guarantees that a website is
associated with a particular company or organization.
Alternatively, you can create your own self-signed certificate. Note,
however, that self-signed certificates should not be used in most
production environments. Self-signed certificates will not be
automatically accepted by a user's browser — the user will be
asked by the browser if they want to accept the certificate and create
the secure connection. See the section called Types of Certificates for
more information on the differences between self-signed and CA-signed
certificates.
Once you have a self-signed certificate or a signed certificate from the
CA of your choice, you will need to install it on your secure Web server.
