SSL certificates and the handshake

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does a browser ask a web server for before an SSL connection starts?

A Its users' passwords

B Its digital certificate

2. Who issues a digital certificate that a browser will trust?

A The person visiting the website

B A trusted certificate authority

3. What does the browser do after it receives the server's digital certificate?

A Checks that it is genuine

B Sends it straight to the user's email

4. Which step happens last in the SSL handshake?

A Both sides agree an encryption key to start the session

B The server asks the browser for its certificate

5. A browser cannot find a valid certificate for a website. What usually happens?

A The browser shows a warning to the user

B The browser silently encrypts the data anyway

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1SSL handshake		AData is sent before the handshake. The certificate has not been checked and no key has been agreed, so the data is not protected.
2digital certificate		BThe start-up steps where the browser gets the server's certificate, checks it, and both sides agree an encryption key
3The browser checks the certificate is genuine before it trusts the server		CA file from a trusted authority that proves a web server is genuine and holds its public key
4Once the certificate is accepted, both sides agree an encryption key to start the session		DThe browser connects even though the certificate is not valid. It should show a warning and not continue silently.
5send(data) BEFORE handshake		Ebrowser.verify(server.certificate)
6IF certificate = invalid THEN connect()		Fsession.key = agreeKey(browser, server)

Definitions

SSL handshake

Fill in the Blanks

Complete each line of code by filling in the missing parts.

browser SENDS request TO server server SENDS ___________ TO browser

valid ← CHECK(certificate, ___________)

IF issuer __ trusted_authorities THEN valid ← TRUE ENDIF

IF valid = _____ THEN DISPLAY warning ENDIF

IF valid THEN AGREE ______________ WITH server ENDIF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A browser connects to server

B server sends its certificate

C browser ignores certificate

D IF genuine THEN agree key

Question 2

A browser asks for a password

B browser checks it is genuine

C browser and server agree key

D secure session starts

Question 3

A browser asks for certificate

B IF certificate is genuine THEN

C show a browser warning

D ELSE show a browser warning

Question 4

A server holds a certificate

B trusted authority issued it

C browser checks the authority

D IF not trusted THEN accept it

Question 5

A browser contacts web server

B browser sends its certificate

C browser checks certificate

D both agree an encryption key

Answer Key

SSL certificates and the handshake

Section A: Quick Questions

B — Its digital certificate

B — A trusted certificate authority

A — Checks that it is genuine

A — Both sides agree an encryption key to start the session

A — The browser shows a warning to the user

Section B: Match the Pairs

SSL handshake → The start-up steps where the browser gets the server's certificate, checks it, and both sides agree an encryption key

digital certificate → A file from a trusted authority that proves a web server is genuine and holds its public key

The browser checks the certificate is genuine before it trusts the server → browser.verify(server.certificate)

Once the certificate is accepted, both sides agree an encryption key to start the session → session.key = agreeKey(browser, server)

send(data) BEFORE handshake → Data is sent before the handshake. The certificate has not been checked and no key has been agreed, so the data is not protected.

IF certificate = invalid THEN connect() → The browser connects even though the certificate is not valid. It should show a warning and not continue silently.

Section C: Definitions

SSL handshake — Browser asks the server for its digital certificate, checks it is genuine, then both agree an encryption key to begin a secure session.

Section D: Fill in the Blanks

browser SENDS request TO server
server SENDS certificate TO browser

valid ← CHECK(certificate, authorities)

IF issuer IN trusted_authorities THEN
    valid ← TRUE
ENDIF

IF valid = FALSE THEN
    DISPLAY warning
ENDIF

IF valid THEN
    AGREE encryption_key WITH server
ENDIF

Section E: Spot the Error

C — The browser must check that the certificate is genuine before it trusts the server. Line 3 should be 'browser checks certificate'.

A — The handshake begins with the browser asking the server for its digital certificate, not a password. Line 1 should be 'browser asks for certificate'.

C — If the certificate is genuine, the browser and server agree an encryption key. The warning belongs only in the ELSE branch. Line 3 should be ' agree an encryption key'.

D — If the certificate does not come from a trusted authority, the browser shows a warning. It must not accept it. Line 4 should be 'IF not trusted THEN warn user'.

B — The web server owns the digital certificate and sends it to the browser. The browser does not send one. Line 2 should be 'server sends its certificate'.