- The Internet Browser sends a request for the secure page along with the encryption options that the browser has available.
- The Web Server sends the User its public key, and its certificate.
- The browser checks that the certificate is valid with the issuing certificate authority.
- The browser generates a random string of characters and concatonates it to the public key sent by the Web Server.
- The browser uses this string of characters to generate a public/private key pair and sends its public key to the server. Along with information about the web page to be accessed. This message is encrypted with the Web Server's public key.
- The Web Server decrypts the message using its private key.
- The Web Server uses the Browser's public key to encrypt the data requested by the Browser.
- The Web Server sends the sensitive information to the browser, and the user is now able to see it.
Secure Socket Layer would be vulnerable to a Man-in-the-Middle attack if it weren't for the Certificate Authority. Having a Trusted third-party is beneficial to most protocols and will help limit the effects of would be attackers.
