An X.509 certi?¬?cate must be associated
with a website for it to be available via HTTPS protocol. Other
keywords often mentioned in this context are SSL (Secure
Sockets Layer) or TSL (Transport Layer Security). Those are the
protocols that actually take care of the security aspects of the
communication. Instead of de?¬?ning brand new security mechanisms,
HTTPS uses such protocols for securing the HTTP traf?¬?c.
Let??™s get back to our example. Bob wants to secure the traf?¬?c to
his website. He then purchases a certi?¬?cate from Trent, who
owns a well-known certi?¬?cation authority. Such a certi?¬?cate will
declare to everybody who trusts Trent??™s word that the public key
contained in the certi?¬?cate is really a key that was awarded to
Bob, or better to www.bob.com. Bob con?¬?gures his website for
using HTTPS and his certi?¬?cates, and then he gives the new
address (https://www.bob.com/bob/homepage.htm) to Alice.
Alice enters the new address in the browser and presses Enter.
Eve, who is using her sniffer for capturing Alice??™s messages, observes
the traf?¬?c on the network, as shown in Figure 1-12.
The answer that Bob??™s Web server sends back is even less clear
(see Figure 1-13).
Pages:
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105