Securing HTTP communication using Secure Socket Layer (SSL)

Securing HTTP communication using Secure Socket Layer (SSL)

1. 1. Alice contacts the SAP NetWeaver Application Server Java using a browser 2. The Application Server responds and sends its Public Key with a digitally-signed message. The client-side server's identity is verified by checking the validity of the certificate. The certificate is only accepted if the client trusts the CA that issued that certificate to the SAP NetWeaver AS Java. This is done with the CA root certificate. 3. The Secret Key is created and encrypted with the Public Key the server sent before 4. The client sends back the encrypted Secret Key 5. On the server the Secret Key is decrypted using the Private Key. Only the server can decrypt the received Secret Key because it is holding the Private Key which is necessary for the decryption. 6. The communication partners perform a “Handshake”. 7. Further communication between the client and the server is encrypted using the Secret Key

2. SSL is not an HTTP-specific protocol but a protocol used between the TCP layer and application protocols like LDAP, SMTP, HTTP

3. SSL uses a Hybrid Encryption method and besides data encryption provides the following authentication mechanisms:

   • Server authentication
   • Client authentication
   • Mutual authentication