SSL offers data integrity and security by enabling secure communication between the client and the server. Now several versions of SSL have been introduced that protect from any vulnerability.
Two-way SSL is also termed mutual authentication. You will get to know a lot more about this authentication, its advantages, and the difference between one-way SSL and two-way SSL here in this article.
Contents
What is Two Way SSL?
In two-way SSL, the validation of both the client and server is required.
2 Way SSL Explained
Two-way SSL is used in places where the server accepts connections from some restricted users only. This is done to mitigate the fraud risk in transactions online.
Such as a company can use two-way SSL if it intends to restrict access to its employees only.
Difference Between One Way SSL and Two Way SSL
SSL is the Secure Socket Layer that offers information security by encrypting the data between the client and server. The basic principles of SSL are encryption, authentication, and data integrity.
The padlock icon present on the address bar of your browser is of One way SSL.
In One way SSL, the verification occurs from one side only, i.e., the client verifies the certificate of the server, and the server doesn’t verify it.
There is a Keystore at the server end. This Keystore has the server’s certificate private and public keys. While on the client-side, there is a truststore that has got the server’s public certificate.
On the other hand, in two way SSL, both the client and server verify each other. The client verifies the server’s certificate, and on the other side, the server verifies the certificate of the client.
The server end has a Keystore that has got the server’s private and public certificate. It also has a trust store with the client’s public certificate.
On the client’s side, there is a Keystore that has got the public and private certificate of the client and a truststore that has got the server’s public key.
2 Way SSL Mutual Authentication
You need to have the following things in order to establish a 2 way SSL connection.
- Private key
- Certificate of client
- CA root certificate
- CA intermediate certificate
The CA intermediate certificate isn’t mandatory.
Two Way SSL Authentication Mechanism
In this authentication mechanism, the authentication and validation of both the client and server are done by each other.
An authentication message exchange occurs between the client and server and is termed as the SSL handshake.
This handshake involves the following steps.
- Firstly the client asks for access to a secured resource.
- Then the server shows its certificate to the client.
- The client verifies this certificate.
- On verifying the server’s certification successfully, the client sends its own certificate to the server.
- Then the server verifies it.
- On successful verification of the client’s certificate, the server provides access to the client to the secured resource he asked for.
In step 5, where the server validates the certificate of the client, is considered to be the second part of the mutual authentication process.
Here the server verifies it and makes sure the client certificate is issued by a trusted CA and is also not expired.
It also confirms the validation of the digital signature of the client. The client produces its digital signature using its private key, and the server validates using the public key of the client.
Advantage of Two Way SSL
It offers a secured and encrypted connection between the client and the server. As both the client and server are authenticated, the connection becomes more secure.
You can implement the Two way SSL to restrict the number of connections too.
Can I Have Two SSL Certificates for the Same Domain?
Yes, you can do that. Many websites on the internet install multiple SSL certificates on one domain.
Before you go ahead with doing so, you need to know some stuff.
If you install multiple SSL certificates on the same domain, then the server will be forced to decide which one of the two certificates to serve.
Sometimes the server sends the most recently installed certificate, while sometimes, it keeps on rotating the certificates.
You will need to do configurations for that.
Reason For Installing Multiple Certificate
Mostly it is done to replace an expiring certificate. Many webmasters install the new certificate without removing the old one, so the site doesn’t remain unprotected even for a second.
You can also install multiple SSL certificates on one domain if you have hosted your single domain on multiple servers.
Summary
SSL ensures data integrity by enabling a secure connection between the client and server.
The one-way SSL involves only the validation of the server by the client. The client need not verify the server in this type of SSL.
To get verified, the server has to share its public certificate with the client.
On the other hand, in two way SSL, both the verification of server and client are required. Firstly the client verifies the server’s identity, and then the server verifies the client’s identity.
The two way SSL authentication mechanism involves a mutual handshake. This is done by exchanging certificates.
Leave a Reply