blocks|key|2335944|text|是的，这就对了。非对称加密是验证其他身份所必需的，然后使用对称加密，因为它更快。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2335945|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Yes, that's right. Asymmetric encryption is necessary to verify the others identity and then symmetric encryption gets used because it's faster.

blocks|key|1978442|text|我建议你把你的更新作为一个单独的问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1978443|在任何情况下-您将需要多个证书-一个网站。请记住，这些证书将您的计算机绑定到您的地址。由于每个网站都有不同的地址(可能)，因此每个网站都需要不同的证书。|1978444|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

I would suggest that you post your update as a separate question. 

In any case - you will require multiple certificate - one per site. Remember that these certificates tie your machine to your address. Since each of the websites is going to have a different address (potentially) , you need different certs for each of the sites

blocks|key|1978446|text|第4点和第5点是错误的，服务器和客户端独立计算相同的会话密钥。它从来没有真正传播过。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1978447|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

You're wrong at points 4 and 5. The server and client independently compute the same session key. It is never actually transmitted at all.

blocks|key|1978468|text|在服务器上，每个侦听端口只能有一个SSL证书。这是因为发送的第一件事是服务器证书(如您的时间线中所示)。这是在HTTP请求之前，因此，如果您试图在单个服务器上承载两个域(例如foo.com和bar.com)，服务器就无法知道要向客户端发送哪个证书。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1978469|解决这个问题有几种不同的方法：|1978470|在不同的服务器上托管不同的域|ordered-list-item|1978471|在不同的端口上托管不同的域(例如。foo.com是从443年开始的，bar.com是从8443开始的)。如果您将主机置于多个负载均衡器之后，您可以让它们在443上为所有站点提供服务。|1978472|如果不同的域都是单亲域的子域，则可以获得通配符证书。(例如域www.foo.com、bar.foo.com和baz.foo.com都可以为*.foo.com使用证书)|1978473|为其中一个域获取一个证书，并将其他域列表为AltNames。(例如，foo.com和bar.com都可以使用foo.com证书和bar.com+AltName)|1978474|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|Q|8|@]|9|@]|A|$]]|$1|G|3|H|5|F|7|R|8|@]|9|@]|A|$]]|$1|I|3|J|5|F|7|S|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|T|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|U|8|@]|9|@]|A|$]]]|N|$]]

You can only have a single SSL cert per listening port on the server. This is because the very first thing that is sent is the server certificate (as in your timeline). This is before the HTTP request so if you try to host two domains on a single server (say foo.com and bar.com) there is no way for the server to know which certificate to send to the client.

There are a few different ways to solve this problem:

<ol>
<li>Host different domains on different servers</li>
<li>Host different domains on different ports (eg. foo.com is serverd from 443 and bar.com is served from 8443). If you put your host behind multiple load-balancers, you can have them service all the sites on 443.</li>
<li>If the different domains are all sub-domains of a single parent domain, you can get a wildcard certificate. (e.g. domains www.foo.com, bar.foo.com, and baz.foo.com can all use a certificate for *.foo.com)</li>
<li>Get a single certificate for one of the domains and have the other domains listed as AltNames. (e.g. both foo.com and bar.com can use a foo.com certificate with a bar.com AltName)</li>
</ol>

blocks|key|781036|text|SSL客户端发送随机字节字符串，使客户端和服务器都能够计算用于加密后续消息数据的密钥。随机字节字符串本身使用服务器的公钥(不对称)加密。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|781037|SSL同时使用非对称密钥和对称密钥。|781038|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

The SSL client sends the random byte string that enables both the client and the server to compute the secret key to be used for encrypting subsequent message data. The random byte string itself is encrypted with the server's public key(Asymmetric).

SSL uses both Asymmetric and symmetric keys.

blocks|key|2336104|text|如果会话密钥由客户机和服务器独立计算，而不需要传输密钥，则为Diffie-Hellman密钥交换：交换+--参见漂亮的画图说明PKI将在客户端和服务器之间交换加密的会话密钥。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2336105|entityMap|0|LINK|mutability|MUTABLE|url|https://en.wikipedia.org/wiki/Diffie%25E2%2580%2593Hellman_key_exchange^0|1D|2|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

The case where the session key is independently computed by the client and server without the key ever being transmitted is Diffie-Hellman key exchange:
<a href="https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange" rel="nofollow">https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange</a>
--- see the nice paint illustration
PKI will exchange the encrypted session key between the client and server.

blocks|key|2336124|text|。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2336125|答案是两者都是。在下面的digicert.com中，您可以从4个步骤找到一个很好的解释：|2336126|2336127|​|2336128|📷|atomic|offset|length|2336129|2336130|blockquote|2336131|服务器发送其非对称公钥的副本。|unordered-list-item|2336132|浏览器创建对称会话密钥，并使用服务器的非对称公钥对其进行加密。然后把它发送到服务器。|style|BOLD|2336133|服务器使用其非对称私钥解密加密的会话密钥以获取对称会话密钥。|2336134|服务器和浏览器现在使用对称会话密钥加密和解密所有传输的数据。这允许使用安全通道，因为只有浏览器和服务器知道对称会话密钥，而会话密钥仅用于该会话。如果浏览器第二天要连接到同一台服务器，则将创建一个新的会话密钥。|2336135|https://www.digicert.com/ssl-cryptography.htm|2336136|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://developer.qcloudimg.com/http-save/yehe-900000/b3f914938c13ba3b2eda263f22aae063.jpg|imageAlt|1|LINK|MUTABLE|url^0|0|0|0|0|0|1|0|0|0|0|0|J|3|0|6|3|0|B|2|0|0|19|1|0^^$0|@$1|2|3|4|5|6|7|1E|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1F|8|@]|9|@]|A|$]]|$1|D|3|4|5|6|7|1G|8|@]|9|@]|A|$]]|$1|E|3|F|5|6|7|1H|8|@]|9|@]|A|$]]|$1|G|3|H|5|I|7|1I|8|@]|9|@$J|1J|K|1K|1|1L]]|A|$]]|$1|L|3|F|5|6|7|1M|8|@]|9|@]|A|$]]|$1|M|3|-4|5|N|7|1N|8|@]|9|@]|A|$]]|$1|O|3|P|5|Q|7|1O|8|@]|9|@]|A|$]]|$1|R|3|S|5|Q|7|1P|8|@$J|1Q|K|1R|T|U]]|9|@]|A|$]]|$1|V|3|W|5|Q|7|1S|8|@$J|1T|K|1U|T|U]]|9|@]|A|$]]|$1|X|3|Y|5|Q|7|1V|8|@$J|1W|K|1X|T|U]]|9|@]|A|$]]|$1|Z|3|10|5|6|7|1Y|8|@]|9|@$J|1Z|K|20|1|21]]|A|$]]|$1|11|3|-4|5|6|7|22|8|@]|9|@]|A|$]]]|12|$13|$5|14|15|16|A|$17|18|19|-4]]|1A|$5|1B|15|1C|A|$1D|10]]]]

.
The answer is both. You will find a nice explanation in 4 steps from digicert.com below:
.
<a href="https://i.stack.imgur.com/lh2ae.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/lh2ae.jpg" alt="enter image description here" /></a>
<blockquote>
<ul>
<li>Server sends a copy of its asymmetric public key.</li>
<li>Browser creates a symmetric session key and encrypts it with the server's asymmetric public key. Then sends it to the server.</li>
<li>Server decrypts the encrypted session key using its asymmetric private key to get the symmetric session key.</li>
<li>Server and Browser now encrypt and decrypt all transmitted data with the symmetric session key. This allows for a secure channel because
only the browser and the server know the symmetric session key, and
the session key is only used for that session. If the browser was to
connect to the same server the next day, a new session key would be
created.</li>
</ul>
</blockquote>
<a href="https://www.digicert.com/ssl-cryptography.htm" rel="nofollow noreferrer">https://www.digicert.com/ssl-cryptography.htm</a>

First, some quotation from Microsoft TechNet's <a href="http://technet.microsoft.com/en-us/library/bb727098.aspx" rel="noreferrer">Managing Microsoft Certificate Services and SSL</a>:

<blockquote>
 To recap, secure SSL sessions are established using the following technique:
 
 <ol>
 <li>The user's Web browser contacts the server using a secure URL.</li>
 <li>The IIS server sends the browser its public key and server certificate.</li>
 <li>The client and server negotiate the level of encryption to use for the
 secure communications.</li>
 <li>The client browser encrypts a session key with the server's public
 key and sends the encrypted data back
 to the server.</li>
 <li>The IIS Server decrypts the message sent by the client using its private
 key, and the session is established.</li>
 <li>Both the client and the server use the session key to encrypt and decrypt
 transmitted data.</li>
 </ol>
</blockquote>

So, basically speaking, the SSL use the asymmetric encryption (public/private key pair) to deliver the shared session key, and finally achieved a communication way with symmetric encryption.

Is this right?

<h2>Add - 1 - 5:55 PM 12/17/2010</h2>

I am using IIS to host my websites. Suppose I have multiple sites on my single machine, and I want the client brower to use SSL URL to connect my sites. How many certificates do I need? Which of the following approach should I take?

1 - Apply for a single certicate and associate it to my single server machine which hosts mutiple sites.

2 - Apply for several certificates and associate each of my sites with its own certificate.

In IIS7, it seems I could only do approach 1.

<h2>Update - 1 - 6:09 PM 12/17/2010</h2>

I figure it out. I could install mutiple certificates on my server machine and bind each site with seperate certificate as necessary.

How does SSL use symmetric and asymmetric encryption? And how do I manage certificated for multiple sites on one host?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

首先，微软TechNet的报价综上所述，使用以下技术建立安全SSL会话：用户的Web浏览器使用安全URL与服务器进行联系。IIS服务器向浏览器发送其公钥和服务器证书。客户端和服务器协商用于安全通信的加密级别。客户端浏览器使用服务器的公钥加密会话密钥，并将加密的数据发送回服务器。IIS服务器使用其私钥解密客户端发送的消息...

问SSL如何使用对称加密和非对称加密？以及如何管理一个主机上的多个站点的证书？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问SSL如何使用对称加密和非对称加密？以及如何管理一个主机上的多个站点的证书？EN