← IGCSE Computer Science Paper 1

SSL certificates and the handshake

Browser asks the server for its digital certificate, checks it is genuine, then both agree an encryption key to begin a secure session.

Part of: IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 46, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 89, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 144, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 50, WA Computer Science ATAR Year 11 — Network Communications — Module 107, WA Computer Science ATAR Year 11 — Cyber Security — Module 95

Understanding SSL certificates and the handshake in IGCSE Computer Science Paper 1

What it does: Verifying the certificate is the check step of the handshake. It stops the browser trusting a fake server. Certificates are issued by a trusted certificate authority, which is why browsers can rely on them. The certificate request and check come first. Once the certificate is accepted, the two sides agree an encryption key to begin the secure session. With no valid certificate, the browser warns the user that the site may not be safe. The handshake is not about malware. It checks the certificate and agrees the key so that data can be encrypted. A certificate shows the website is genuine, but it does not make the website immune to attack.

Common mistakes: The browser must check that the certificate is genuine before it trusts the server. Line 3 should be 'browser checks certificate'. The handshake begins with the browser asking the server for its digital certificate, not a password. Line 1 should be 'browser asks for certificate'.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add SSL certificates and the handshake to a class →

This module's key terms are also in a printable crossword (Modules 553–577) and word search (Modules 553–607).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What does a browser ask a web server for before an SSL connection starts?
Its digital certificateIts users' passwords
Matches
send(data) BEFORE handshake
↓
Data is sent before the handshake. The certificate has not been checked and no key has been agreed, so the data is not protected.
Applying
Meanings
Term
SSL handshake
Meaning
Browser asks the server for its digital certificate, checks it is genuine, then both agree an encryption key to begin a secure session.
Practice
REQUEST certificate FROM server
Testing
Gaps
server SENDS TO browser
Check Answer
Spots
2server sends its certificate
3browser ignores certificate

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Deer' badge — Forest Streak, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What does a browser ask a web server for before an SSL connection starts?
A. Its users' passwords
B. Its digital certificate ✓
The browser asks the server for its digital certificate to check the site is genuine before any secure session begins.
2. Who issues a digital certificate that a browser will trust?
A. The person visiting the website
B. A trusted certificate authority ✓
Certificates are issued by a trusted certificate authority, which is why browsers can rely on them.
3. What does the browser do after it receives the server's digital certificate?
A. Checks that it is genuine ✓
B. Sends it straight to the user's email
The browser checks the certificate is genuine and valid before it carries on with the handshake.
4. Which step happens last in the SSL handshake?
A. Both sides agree an encryption key to start the session ✓
B. The server asks the browser for its certificate
The certificate request and check come first. Once the certificate is accepted, the two sides agree an encryption key to begin the secure session.
5. A browser cannot find a valid certificate for a website. What usually happens?
A. The browser shows a warning to the user ✓
B. The browser silently encrypts the data anyway
With no valid certificate, the browser warns the user that the site may not be safe.

Match the Pairs

SSL handshake → The start-up steps where the browser gets the server's certificate, checks it, and both sides agree an encryption key
digital certificate → A file from a trusted authority that proves a web server is genuine and holds its public key
The browser checks the certificate is genuine before it trusts the server → browser.verify(server.certificate)
Once the certificate is accepted, both sides agree an encryption key to start the session → session.key = agreeKey(browser, server)
send(data) BEFORE handshake → Data is sent before the handshake. The certificate has not been checked and no key has been agreed, so the data is not protected.
IF certificate = invalid THEN connect() → The browser connects even though the certificate is not valid. It should show a warning and not continue silently.

Key Term

SSL handshake
Browser asks the server for its digital certificate, checks it is genuine, then both agree an encryption key to begin a secure session.

Fill in the Blanks

1. browser SENDS request TO server server SENDS certificate TO browser
Hint: Type the digital document the server sends to prove who it is.
2. valid ← CHECK(certificate, authorities)
Hint: Type the name of the list of trusted bodies the browser compares the certificate's issuer against.
3. IF issuer IN trusted_authorities THEN valid ← TRUE ENDIF
Hint: Type the keyword that tests whether the issuer is a member of the trusted list.
4. IF valid = FALSE THEN DISPLAY warning ENDIF
Hint: Type the Boolean value that means the certificate is not valid, so the browser shows a warning.
5. IF valid THEN AGREE encryption_key WITH server ENDIF
Hint: Type the variable name for what the browser and server agree to start the secure session.

Spot the Error

Question 1
A browser connects to server
B server sends its certificate
C browser ignores certificate
D IF genuine THEN agree key
Line C — The browser must check that the certificate is genuine before it trusts the server. Line 3 should be 'browser checks certificate'.
Question 2
A browser asks for a password
B browser checks it is genuine
C browser and server agree key
D secure session starts
Line A — The handshake begins with the browser asking the server for its digital certificate, not a password. Line 1 should be 'browser asks for certificate'.
Question 3
A browser asks for certificate
B IF certificate is genuine THEN
C show a browser warning
D ELSE show a browser warning
Line C — If the certificate is genuine, the browser and server agree an encryption key. The warning belongs only in the ELSE branch. Line 3 should be ' agree an encryption key'.
Question 4
A server holds a certificate
B trusted authority issued it
C browser checks the authority
D IF not trusted THEN accept it
Line D — If the certificate does not come from a trusted authority, the browser shows a warning. It must not accept it. Line 4 should be 'IF not trusted THEN warn user'.
Question 5
A browser contacts web server
B browser sends its certificate
C browser checks certificate
D both agree an encryption key
Line B — The web server owns the digital certificate and sends it to the browser. The browser does not send one. Line 2 should be 'server sends its certificate'.

Student with a class code? Join your class →