SSL
SSL (Secure Sockets Layer) plays a crucial role in securing communication between components over a network. Though it's often used interchangeably with TLS (Transport Layer Security) — which is the modern, more secure version — the term SSL is still commonly used to refer to the entire HTTPS security mechanism.
What is SSL in System Design?
SSL is a cryptographic protocol that ensures:
- Confidentiality – Data is encrypted so that third parties can't read it.
- Integrity – Data isn't altered during transmission.
- Authentication – The identity of servers (and optionally clients) is verified.
Where SSL Fits in System Design
SSL is applied at the transport layer (between the application and network layers). In system design, it's often used in:
- Web applications (HTTPS)
- Microservices (mutual TLS)
- Mobile apps communicating with APIs
- Database access over networks
SSL Workflow
- Client connects to server using HTTPS(Initialized request are always HTTPS)
- SSL/TLS Handshake begins:
- Server sends its SSL certificate (with public key - server have both public and private key, so its distribute its public to all the client)
- Client verifies certificate (using Certificate Authority)
- A shared session/symmetric key is negotiated using public/private key encryption (e.g., Diffie-Hellman)
- Client generate a symmetric(it's fast) with the public key
- symmetric key is shared with server and decrypted by servers private key
- connection established and symmetric key will be used for further uses
- Encrypted communication starts using the session key