Title: Notes on SSL/TLS
Course: Introduction to SSL/PKI > Section: Information For Teachers

Notes on SSL/TLS

It should be emphasized the the both ends of a secure connection should verify who is on the other end of the connection before sending sensitive information.

For example, in a typical web browser, web server connection, the client knows who it is connected to because it verified the PKI certificate (and the name in it) that it received from the server. The server, however, does not know who it is connected too. The sever's first step is usually to ask the client for a username and password to verify who it is talking to.

Note: Web browsers allow user authentication PKI certificates to be installed. When a SSL connection is created PKI certificates are exchanges. Thus, both ends of the connection know who they are talking to. After the connection is made, the server uses the "identity" sent from the client to determine what the client is authorized to do (if anything). Obviously the authentication PKI certificate must be kept safe, or someone can use it to pretend to be the client.

Remember, SSL will allow you to communicate very securely with the wrong person.