SSL如何使用对称和非对称加密？如何管理一台主机上多个站点的认证？
首先，引用 Microsoft TechNet 的管理 Microsoft 证书服务和 SSL：
回顾一下，安全 SSL 会话是使用以下技术建立的：
用户的 Web 浏览器使用安全 URL 联系服务器。
IIS 服务器向浏览器发送其公钥和服务器证书。
客户端和服务器协商用于加密的级别 安全通信。
客户端浏览器使用服务器的公钥加密会话密钥 密钥并将加密数据发回 到服务器。
IIS 服务器使用其私有密钥解密客户端发送的消息 键，会话建立。
客户端和服务器端都使用会话密钥进行加密和解密 传输数据。
所以，基本上来说，SSL使用非对称加密（公钥/私钥对）来传递共享会话密钥，最终实现了对称加密的通信方式。
这是对的吗？
添加 - 1 - 5:55 PM 12/17/2010
我正在使用 IIS 托管我的网站。假设我的一台计算机上有多个站点，并且我希望客户端浏览器使用 SSL URL 来连接我的站点。我需要多少证书？我应该采取以下哪种方法？
1 - 申请单个证书并将其关联到托管多个站点的单个服务器计算机。
2 - 申请多个证书并将我的每个站点与其自己的证书相关联。
在 IIS7 中，似乎我只能执行方法 1。
更新 - 1 - 6:09 PM 12/17/2010
我弄清楚了。我可以在我的服务器计算机上安装多个证书，并根据需要使用单独的证书绑定每个站点。
First, some quotation from Microsoft TechNet's Managing Microsoft Certificate Services and SSL:
To recap, secure SSL sessions are established using the following technique:
The user's Web browser contacts the server using a secure URL.
The IIS server sends the browser its public key and server certificate.
The client and server negotiate the level of encryption to use for the
secure communications.The client browser encrypts a session key with the server's public
key and sends the encrypted data back
to the server.The IIS Server decrypts the message sent by the client using its private
key, and the session is established.Both the client and the server use the session key to encrypt and decrypt
transmitted data.
So, basically speaking, the SSL use the asymmetric encryption (public/private key pair) to deliver the shared session key, and finally achieved a communication way with symmetric encryption.
Is this right?
Add - 1 - 5:55 PM 12/17/2010
I am using IIS to host my websites. Suppose I have multiple sites on my single machine, and I want the client brower to use SSL URL to connect my sites. How many certificates do I need? Which of the following approach should I take?
1 - Apply for a single certicate and associate it to my single server machine which hosts mutiple sites.
2 - Apply for several certificates and associate each of my sites with its own certificate.
In IIS7, it seems I could only do approach 1.
Update - 1 - 6:09 PM 12/17/2010
I figure it out. I could install mutiple certificates on my server machine and bind each site with seperate certificate as necessary.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
SSL 客户端发送随机字节字符串，使客户端和服务器能够计算用于加密后续消息数据的密钥。随机字节串本身使用服务器的公钥加密（非对称）。
SSL 使用非对称和对称密钥。
The SSL client sends the random byte string that enables both the client and the server to compute the secret key to be used for encrypting subsequent message data. The random byte string itself is encrypted with the server's public key(Asymmetric).
SSL uses both Asymmetric and symmetric keys.
会话密钥由客户端和服务器独立计算而无需传输密钥的情况是 Diffie-Hellman 密钥交换：
https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
---看漂亮的油漆插图
PKI 将在客户端和服务器之间交换加密的会话密钥。
The case where the session key is independently computed by the client and server without the key ever being transmitted is Diffie-Hellman key exchange:
https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
--- see the nice paint illustration
PKI will exchange the encrypted session key between the client and server.
服务器上的每个侦听端口只能有一个 SSL 证书。这是因为发送的第一件事是服务器证书（如您的时间线中所示）。这是在 HTTP 请求之前，因此如果您尝试在单个服务器上托管两个域（例如 foo.com 和 bar.com），服务器将无法知道要向客户端发送哪个证书。
有几种不同的方法可以解决此问题：
You can only have a single SSL cert per listening port on the server. This is because the very first thing that is sent is the server certificate (as in your timeline). This is before the HTTP request so if you try to host two domains on a single server (say foo.com and bar.com) there is no way for the server to know which certificate to send to the client.
There are a few different ways to solve this problem:
第 4 点和第 5 点是错误的。服务器和客户端独立计算相同的会话密钥。它实际上从未被传输过。
You're wrong at points 4 and 5. The server and client independently compute the same session key. It is never actually transmitted at all.
。
答案是两者皆有。您将在下面的 digicert.com 中找到 4 个步骤的详细解释：
。
https://www.digicert.com/ssl-cryptography.htm
.
The answer is both. You will find a nice explanation in 4 steps from digicert.com below:
.
https://www.digicert.com/ssl-cryptography.htm
我建议您将更新作为单独的问题发布。
无论如何 - 您将需要多个证书 - 每个站点一个。请记住，这些证书将您的机器与您的地址联系起来。由于每个网站（可能）都有不同的地址，因此每个网站都需要不同的证书
I would suggest that you post your update as a separate question.
In any case - you will require multiple certificate - one per site. Remember that these certificates tie your machine to your address. Since each of the websites is going to have a different address (potentially) , you need different certs for each of the sites
是的，没错。非对称加密对于验证其他人的身份是必要的，然后使用对称加密，因为它更快。
Yes, that's right. Asymmetric encryption is necessary to verify the others identity and then symmetric encryption gets used because it's faster.