I was thinking of using SSL on my webserver - and looked it up:

http://support.microsoft.com/default.aspx?scid=kb;en-us;299525

Would someone explain to me how a cerficate functions and what it is
doing behing the scenes. I assume all the data is encrypted then
decrypted at the client end - right?

Anyone coming to my site will be prompted for a certificate - correct?
Or it is done automatically.

How greatly is speed affected/

When I generate a certificate - do I have to get it verified by some
third party - like Verisign?

SSL is of use only if my data is very secret and I do not want others
to see it. For general information - it probably does not matter -
correct?

Thanks,

Hi,

Here is Microsoft article that describes in detail what is going behind the
screen when someone tries to access your web site that is protected by SSL.

Description of the Secure Sockets Layer (SSL) Handshake
http://support.microsoft.com/default.aspx?scid=kb;EN-US;257591

SSL is used when clients needs to transfer data between computers in secure
manner.
This data can be e.g.
* username and password when users authenticates to server (e.g. to check
his/her e-mail) (client sends this data to the server)
* content of the e-mail (sent from server to client)
* information about your bank account (sent from server to client)
* credit card number that you enter when peforming on-lins shopping (sent
from client to server)

If you want your users (maybe your clients) to trust your SSL certificate
you will need to obtain certificate signature from Versign or Thavte
(cheaper) or some other certification authority.
If you need these certificates only for internal use you can e.g. setup your
own certificate authority server or use SelfSSL utility from IIS 6 resource
kit.
If you have a domain environment it is quite simple to make your domain
clients trust your own certificate authority.

Here are some links that you might want to look at:
IIS 6.0 Resource Kit Tools
http://www.microsoft.com/downloads/details.aspx?FamilyID=56fc92ee-a71a-4c73-b628-ade629c89499&DisplayLang=en

Best Practices for Implementing a Microsoft Windows Server2003 Public Key
Infrastructure
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/ws3pkibp.mspx

Windows Server 2003 PKI Operations Guide
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/ws03pkog.mspx

Managing a Windows Server 2003 Public Key Infrastructure
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/mngpki.mspx

I hope this helps,

Mike

[quoted text, click to view]