The role and mechanism of SSL certificates

This is Nakagawa from the Systems Solutions Department.
I've been working on a lot of SSL server certificate-related tasks lately, so I looked into how they work.

What is an SSL server certificate?

What exactly is an SSL server certificate? Its
encrypted communication of personal informationandverification of the identity of the business owner or company operating the websitemain roles are
SSL (Secure Sockets Layer)is a technology that encrypts information communication between a computer and a server.
Using SSL
allows you to safely exchange personal information, credit card information, etc., when using online shopping or services that require login information.
It also protects important data from eavesdropping, tampering, and impersonation by third parties.

How to identify sites that have SSL installed

So, what kinds of websites have certificates installed?
Checking the URL bar makes it easy to see.

The URL in your browser begins with "https" and there is a lock symbol in the URL field

The entire site uses encrypted communication, ensuring secure information exchange.
Clicking this key icon allows you to check the details and expiration date of the installed certificate.
The display method may vary depending on your browser.

The browser URL begins with "https", but there is no lock symbol in the browser URL

The certificates themselves are either not installed, or they are installed but
the site's internal communications are either encrypted or not.

The URL in your browser begins with "https" and there is a red icon in the URL field

This means that either the certificate is not installed or the certificate has expired

Certificate issuance and installation process

So how can you use a certificate?
To use one,apply to the Certificate Authority (CA) that issued the certificateyou need to
While there are some differences depending on the CA and the type of certificate, the basic issuance procedure is as follows:

1. Apply to a certification authority
2. Certification Authority Review
3. Certificate issuance and delivery
4. Install on the server

The more reliable something is, the more time-consuming and laborious approval review is required

Reality check

The reason why a certification authority's review is necessary to issue a certificate
is to investigate whether a business owner or company exists that operates the site.

Since all websites are essentially publicly accessible, with their source code essentially publicly available,
it's not impossible to create a fake website that mimics a real one.

Therefore, the following review process is required to verify the legitimacy of the site.
If the following review is successful, a certificate will be issued for the applied domain.

• The domain you applied for is owned by you
• Is the applicant a real business owner or company?

The issuance of a certificate means that the domain is operated by a legitimate administrator.
However, the review process only confirms that the business owner or company is a real entity. This
is a separate issue from whether the business owner or company operating the website is trustworthy.

So, what did you think?
We've shown you the inner workings of how personal information is securely exchanged on websites you use every day without even realizing it.

Thank you for reading this far!