Could anybody explain to me where did my browser get SSL certificates? As I understand, communication between me (a client) and web application (server) going through public-private keypair exchange, and I should have my own public-private key ( + server public key).

I can't understand what is used as my certificate? Does my browser generate it?

Or it is preinstalled? Does it generate a certificate for each connection or for each web site?

If my browser generate certificate, how it possible to do this - https://news.ycombinator.com/item?id=10663843 ?

Kazakhstan to MitM all HTTPS traffic starting Jan 1

  • This is off-topic here. Your browser does not generate certificates. Kazakhstan will likely legally require all people in the country to have a device that has Kazakhstan's certificate authority listed as a trusted provider, so that they can issue valid certificates for any domain. They will then inject those between the sites and the users via a national firewall. China has done this for decades. – ceejayoz Dec 6 '17 at 12:49

Your browser does not generate a certificate - rather the public key is provided to you by the https website and verified by a Certification Authority (CA) that your browser trusts.

There are a bunch of trusted CAs distributed with your OS and/or browser - and indeed if a CA is compromised, or a non- trusted CA cert can be added to the machine the owner of the CA can MITM the traffic and see everything.

  • So, during https communication, we working only with one certificate? If so, when I send request to server, I can encrypt message by server public key, and only server will be able to read my request. But then, server will send response, and encrypt message by private key, and anybody will be able to read response. It did not look like true. – degr Dec 8 '17 at 7:04
  • No, during HTTPS communication you work with at least 2 (in practice more because certificates usually link to other certificates). The certificates used are the servers private key and the servers CA's public key (which is included with your browser/os). Only the server will be able to read your request and send you an encrypted response which only your browser can read. [ Note that it is possible for the CA to perform a man-in-the-middle attack, but assuming you talk to the server securely, they cant decrypt the response the server sent ] – davidgo Dec 8 '17 at 8:59
  • Also, I believe that as part of the session is negotiation, the client sends the equivalent of a public key (associated with the equivalent of a private key which is can be generated on demand and thrown away at the end of the session) to the server. In this way, in effect, each party has their own private key for the session and the others public key. – davidgo Dec 8 '17 at 9:11
  • I believe that as part of the session is negotiation, the client sends the equivalent of a public key - Yes, and now back to my question - when and how does my browser generate certificate (public-private key pair)? – degr Dec 8 '17 at 9:18
  • Have a look at robertheaton.com/2014/03/27/how-does-https-actually-work - This process happens as part of key exchange - which means its done at the time the HTTPS request is made, and the how depends on the cipher/algorythm used (which is also negotiated based on the preferences and abilities of each browser) – davidgo Dec 8 '17 at 9:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.