Security - An Explanation

Most common browsers include an indication in the bottom of the window when you are communicating with a secure server:

When a secure server is indicated, data that you send and receive is encrypted, which prevents anyone but you and the server from seeing the information exchanged. The protocol by which this takes place is called SSL - secure sockets layer.

In order to ensure that your SSL connection is to the actual server you intend, certificates and certificate authorities are used. The secure server and your browser automatically exchange certificate information when establishing a connection. If the certificate can be authenticated by a trusted certificate authority, the secure page will come up automatically.

Most browser come with a pre-defined list of trusted certificate authorities that include Verisign and Thawte, and sometimes with GeoTrust/Equifax. If you connect to a secure server authenticated by an authority not included in your browser's list, or if any of the information does not match, or, in some cases, if you have an old browser that needs an update, you may get a security warning. Here's an explanation of Internet Explorer's Security Alerts:

The alert identifies up to 3 reasons for the alert - the certifying authority, date validity, and the site name (URL).

In the case shown to the right, the name used did not match. (I forced this error by using https://www.sitename when the certificate was issued for https://sitename.

If you proceed - by selecting Yes, your connection will be encrypted.

If you select No, you won't connect at all or see the page.

The last option, View Certificate, allows you to see information about the certificate, and optionally install it.

View Certificate: Will show who the certificate was issued to (site URL), who it was issued by, and the certificates validity dates.

NOTE: Some older un-updated browsers may give a date alert on a valid date. You'll need to download the update/patches for your browser to solve this. You may also have a problem Installing a Certificate on older browsers.

You can get even more details about the certificate and the authority by clicking the Details tab.

You can Install Certificate... to eliminate the Security Alert on future visits to the site, and/or to any site with a certificate issued by the authority.

Clicking install certificate will start a wizard that imports the certificate into your certificate store.

Remember, you will have an encrypted connection using SSL if you click Yes to proceed when you get a Security Alert.

LEVEL OF ENCRYPTION: A pop-up balloon will display if you move your mouse over the browser's secure icon:

128 bit encryption is the most secure level available today. Some browsers, especially outside the US, may not support 128-bit encryption. The lowest standard encryption level, 40-bit, is still difficult to crack and would require a determined and sophisticated effort.

Security & SSL Certificates