8.8.1. SSL/TLS Certificates: Background

Engineering Knowledge Manager

Installation Guide | Chapter 8: Installing a Front-End Web Server | 8.8. Overview of Client-Web Server Communications |

8.8. Overview of Client-Web Server Communications |  | 8.8.2. Enabling Secure Connections to the Web Server (Optional)
Prev |  | Next

### 8.8.1. SSL/TLS Certificates: Background

In order to support encrypted connections using HTTPS, a web server must possess a signed Secure Sockets Layer (SSL)/TLS certificate, commonly referred to as a cert. A complete discussion of how HTTPS works is beyond the scope of this document, but the following provides a quick, highly-simplified overview.

HTTPS is not really a protocol in and of itself, but rather a combination of HTTP on top of SSL/TLS, which are encryption protocols. SSL/TLS are asymmetric encryption protocols that use mathematically-related public/private key pairs at each endpoint to encrypt and decrypt messages between communication partners.

SSL/TLS relies on a Public Key Infrastructure (PKI) in order to establish trust between communication partners. In this public key infrastructure, trusted third-parties known as Certificate Authorities perform the role of verifying the identity of entities such as web servers, and digitally signing SSL/TLS certificates for those entities.

An SSL/TLS certificate for an entity contains the public key of the entity and information about its identity, and is digitally signed with the private key of the signing Certificate Authority (CA). When a client web browser connects to a web server and initiates an HTTPS connection, the web server presents the client browser with its SSL/TLS certificate. Web browsers typically include local copies of the root (or “signing”) certificates of major Certificate Authorities. The root certificate of the CA contains its public key, which can be used to validate whether a given certificate has been signed by that CA because certificate signing is done using the CA’s private key. When a client browser is presented with a web server’s certificate, the client browser verifies that the certificate was signed by the CA that it claims to have been signed by. Once the web server’s certificate is authenticated, the client browser can trust that the web server is who it says it is because rigorous validation of the identity of an entity is central to the issuing process for SSL/TLS certificates from reputable Certificate Authorities.

Once the certificate is accepted as valid, the client browser can proceed with setting up an encrypted HTTPS connection with the web server.

Contains proprietary and confidential information of ANSYS, Inc. and its subsidiaries and affiliates.

Prev | Up / Contents | Next

Release 18.2 - © ANSYS, Inc. All rights reserved.