Application Data Protection Techniques - Secure Java: For Web Application Development - page 193

Application

Transport
Internet

Network
Interface

TCP/IP

Figure 8.13 SSL/tLS in the tCP/IP Stack.

Client Initiation
Server Acknowledgement

Send Certificate*
Request Certificate*
Server Key Exchange*
Server Ready

Send Certificate*

Server

Client Key Exchange

Client

Certificate Verification*

Change Cypher Specs

Handshake Establishment
Change Cypher Specs

Handshake Establishment

Encrypted Data Exchange

Close

Figure 8.14 the SSL/tLS handshake process.

SSL/TLS essentially begins with a series of exchanges of information between the client and the
server. his series of exchanges of information is called the SSL handshake . he SSL/TLS hand-
shake ensures negotiation of the cipher suite, authentication, and agreement on encryption algo-
rithms for establishing the information security.
A sequence of messages is exchanged between the two systems, namely, client and server, in the
SSL mode of data transfer. Figure 8.14 exempliies the sequence along with details in each step.

Acquiring the SSL/TLS certiicate: he Web application vendor or organization will obtain
a certiicate from a certiicate provider with a certiicate signing request . his request con-
tains the name of the Web application/Web site, contact email address, and company infor-
mation. he certiicate provider would sign the request after scrutiny of the same, which