SSL 相关文章 理解整理

最近在读和SSL相关的内容，做了些整理

[资源1] http://docs.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#SSLOverview

Secure Sockets Layer (SSL) Protocol Overview
Secure Sockets Layer (SSL) is the most widely used protocol for implementing cryptography on the Web. SSL uses a combination of cryptographic processes to provide secure communication over a network. This section provides an introduction to SSL and the cryptographic processes it uses.
【译文】SSL 协议是在Web信息传输中应用最广泛的加密协议。SSL 在网络中提供了一系列的密码机制提供安全的信息通信。这部分内容将主要介绍SSL和加密过程。

SSL provides a secure enhancement to the standard TCP/IP sockets protocol used for Internet communications. As shown in the “TCP/IP Protocol Stack With SSL” figure below, the secure sockets layer is added between the transport layer and the application layer in the standard TCP/IP protocol stack. The application most commonly used with SSL is Hypertext Transfer Protocol (HTTP), the protocol for Internet Web pages. Other applications, such as Net News Transfer Protocol (NNTP), Telnet, Lightweight Directory Access Protocol (LDAP), Interactive Message Access Protocol (IMAP), and File Transfer Protocol (FTP), can be used with SSL as well.
【译文】在互联网中，SSL 基于TCP/IP 提供了安全的信息交互协议。正如下面所示，在TCP/IP协议的传输层和应用层中间增加了安全的Socket层。应用层的HTTP通常使用SSL提供超文本传输，这个协议在互联网的网页中非常常见。其他的应用程序，比如NNTP，Telnet，LDAP，IMAP和FTP 都可以应用SSL 协议。

Note: There is currently no standard for secure FTP.
目前没有标准的安全的FTP协议。

TCP/IP Protocol Stack With SSL
| TCP/IP Layer | Protocol
| Application Layer | HTTP, NNTP, Telnet, FTP, etc.|
| Secure Sockets Layer | SSL |
| Transport Layer| TCP|
| Internet Layer| IP|

具有SSL的TCP/IP 协议栈
| TCP/IP 层次| 协议名
| 应用层 | HTTP, NNTP, Telnet, FTP, etc.|
| 安全 Sockets 层 | SSL |
| 传输层 | TCP |
| 广域网层 | IP |

SSL was developed by Netscape in 1994, and with input from the Internet community, has evolved to become a standard. It is now under the control of the international standards organization, the Internet Engineering Task Force (IETF). The IETF has renamed SSL to Transport Layer Security (TLS), and released the first specification, version 1.0, in January 1999. TLS 1.0 is a modest upgrade to the most recent version of SSL, version 3.0. The differences between SSL 3.0 and TLS 1.0 are minor.

SSL是1994年网景公司和社区公共开发的，现在已经成为一个标准的传输协议。这个协议目前接受IETF管理，IETF 把SSL 重命名为TLS ，并且在1999年1月发布了第一个规范 TLS 1.0. 这个规范 被升级到目前最近的版本SSL 3.0 ， SSL3.0 和TLS1.0之间只是做了很小的调整。

Why Use SSL?
为什么使用SSL？
Transferring sensitive information over a network can be risky due to the following three issues:

1. You cannot always be sure that the entity with whom you are
   communicating is really who you think it is.
2. Network data can be intercepted, so it is possible that it can be
   read by an unauthorized third party, sometimes known as an attacker.
3. If an attacker can intercept the data, the attacker may be able to
   modify the data before sending it on to the receiver.

在网络中传输敏感信息会冒很大的风险，会面临以下三个问题的影响：
1.你不能保证你正在交互的实体就真的是你想联系的那个。
2.网络中的数据可以被第没有经过允许的第三方拦截，往往这个第三方就是一名黑客。
3.如果数据可以被拦截，那么黑客就能够在数据到达接收方之前修改数据。

SSL addresses each of these issues. It addresses the first issue by optionally allowing each of two communicating parties to ensure the identity of the other party in a process called authentication. Once the parties are authenticated, SSL provides an encrypted connection between the two parties for secure message transmission. Encrypting the communication between the two parties provides privacy and therefore addresses the second issue. The encryption algorithms used with SSL include a secure hash function, which is similar to a checksum. This ensures that data is not modified in transit. The secure hash function addresses the third issue of data integrity.
SSL 解决了这些问题，它通过身份认证来识别通信的一方或者双方。一旦身份被确认，SSL在通信双方提供一个加密的信息通信来解决第二个问题，SSL中使用的加密算法提供了哈希功能，这个就像checksum，这就确保了传输过程中信息没有被修改，因此解决了第三个问题。

Note, both authentication and encryption are optional, and depend on the the negotiated cipher suites between the two entities.
注意，身份认证和机密都是可选的，他取决于通信双方的密码协商机制。

The most obvious example of when you would use SSL is in an e-commerce transaction. In an e-commerce transaction, it would be foolish to assume that you can guarantee the identity of the server with whom you are communicating. It would be easy enough for someone to create a phony Web site promising great services if only you enter your credit card number. SSL allows you, the client, to authenticate the identity of the server. It also allows the server to authenticate the identity of the client, although in Internet transactions, this is seldom done.

最明显的就是当你使用SSL协议进行电子购物的时候，在电子购物过程中，一个很笨的做法就是你可以生成一个和你想要通信的server端完全一样的实体。对于某些人来说，如果你只是输入信用卡账号的话，这个足够容易让他们建立一个假冒server的站点。SSL可以让你在客户端去验证服务器端的真实身份，也允许server验证client端的身份，但后者很少用到。

Once the client and the server are comfortable with each other’s identity, SSL provides privacy and data integrity through the encryption algorithms it uses. This allows sensitive information, such as credit card numbers, to be transmitted securely over the Internet.
一旦客户端和server端确认了彼此之间的真实身份，ssl可以通过加密算法提供私密的数据交互，这就允许很多敏感的信息可以在互联网中进行传输，比如信用卡账号等等。

While SSL provides authentication, privacy, and data integrity, it does not provide non-repudiation services. Non-repudiation means that an entity that sends a message cannot later deny that they sent it. When the digital equivalent of a signature is associated with a message, the communication can later be proved. SSL alone does not provide non-repudiation.
当SSL 结束了验证，保密性和完整性，他还可以提供不可抵赖的服务，不可抵赖意味着 一个实体不能在他发送完信息之后否认他发送了信息。当签名内容和信息一起发送之后，通信过程可以证实这一点。SSL也可以独自的实现不提供不可抵赖行的服务。

How SSL Works
One of the reasons SSL is effective is that it uses several different cryptographic processes. SSL uses public key cryptography to provide authentication, and secret key cryptography and digital signatures to provide for privacy and data integrity. Before you can understand SSL, it is helpful to understand these cryptographic processes.

SSL是如何工作的
是SSL高效的原因是他可以使用不同加密机制。SSL使用公钥来提供身份认证，使用私钥加密和数字签名来保证私密性和数据的完整性。在你理解SSL 之前，理解一下以下的加密过程也是十分有帮助的。

Cryptographic Processes
The primary purpose of cryptography is to make it difficult for an unauthorized third party to access and understand private communication between two parties. It is not always possible to restrict all unauthorized access to data, but private data can be made unintelligible to unauthorized parties through the process of encryption. Encryption uses complex algorithms to convert the original message, or cleartext, to an encoded message, called ciphertext. The algorithms used to encrypt and decrypt data that is transferred over a network typically come in two categories: secret key cryptography and public key cryptography. These forms of cryptography are explained in the following subsections.
加密过程
加密过程的主要目的是，确保第三方能够读取到并且理解双方私密的通信过程，这并不是说要约束未被认证的人读取这些数据，而是通过加密之后，让未被认证的人读取道信息的时候让他们无法理解信息的内容。加密用复杂的算法把原始信息或者是明文转化成加密的信息，我们称之为密文。算法通常能够实现加密和解密，在网络传输过程中典型的分成两类：私钥加密和公钥加密。这些加密形式我们将在下面的内容中做解释。

Both secret key cryptography and public key cryptography depend on the use of an agreed-upon cryptographic key or pair of keys. A key is a string of bits that is used by the cryptographic algorithm or algorithms during the process of encrypting and decrypting the data. A cryptographic key is like a key for a lock: only with the right key can you open the lock.
不管是公钥加密还是私钥加密都取决于密钥或者是密钥对。密钥就是一组字符串，它通常被密码算法或者是在算法的加密或者解密数据中使用，一个密钥就像一把钥匙可以打开一把锁一样。

Safely transmitting a key between two communicating parties is not a trivial matter. A public key certificate allows a party to safely transmit its public key, while ensuring the receiver of the authenticity of the public key. Public key certificates are described in a later section.
在两个通信实体之间安全的交换密钥时十分繁琐的。公开的密钥允许两个确保验证过的实体之间公开的的传递他的公钥，公钥证书我们一会儿在介绍。

In the descriptions of the cryptographic processes that follow, we use the conventions used by the security community: we label the two communicating parties with the names Alice and Bob. We call the unauthorized third party, also known as the attacker, Charlie.
在接下来的加密过程中，我们用两个安全实体一个叫小红和小明来实现安全的回话，我们把没有经过身份验证的第三方黑客叫小黑。

Secret Key Cryptography
私钥加密
With secret key cryptography, both communicating parties, Alice and Bob, use the same key to encrypt and decrypt the messages. Before any encrypted data can be sent over the network, both Alice and Bob must have the key and must agree on the cryptographic algorithm that they will use for encryption and decryption.
在私钥加密中，不管小红还是小明，都使用相同的密钥进行加密和解密。在加密之前密钥可以先通过网络进行发送，小红和小明必须得有密钥并且必须协商好在加密和解密过程中的密码算法。

One of the major problems with secret key cryptography is the logistical issue of how to get the key from one party to the other without allowing access to an attacker. If Alice and Bob are securing their data with secret key cryptography, and if Charlie gains access to their key, Charlie can understand any secret messages he intercepts between Alice and Bob. Not only can Charlie decrypt Alice’s and Bob’s messages, but he can also pretend that he is Alice and send encrypted data to Bob. Bob will not know that the message came from Charlie, not Alice.
私钥加密过程中一个逻辑性的问题就是，如何保证密钥在从一个实体到另外一个实体的过程中不被小黑读取。如果小红和小明用密钥加密了数据 ，但是小黑获得了他们的密钥，整个传输过程的数据将被小黑一览无余，小黑还可以伪装成小红给小明发信息，小明还不知道这个信息来自于小黑而不是小红。

Once the problem of secret key distribution is solved, secret key cryptography can be a valuable tool. The algorithms provide excellent security and encrypt data relatively quickly. The majority of the sensitive data sent in an SSL session is sent using secret key cryptography.
一旦密钥分发问题被解决，私钥加密可以是一个很好的工具。加密算法非常安全并且加密过程非常快，当然主要的敏感的数据在SSL中发送过程中采用私钥加密(这里不太理解作者的真实意思)。

Secret key cryptography is also called symmetric cryptography because the same key is used to both encrypt and decrypt the data. Well-known secret key cryptographic algorithms include the Data Encryption Standard (DES), triple-strength DES (3DES), Rivest Cipher 2 (RC2), and Rivest Cipher 4 (RC4).

私钥加密也被成为对称加密，因为相同的密钥用来加密和解密。比较知名的私钥加密算法有：DES,3DES,RC2和RC4

Public Key Cryptography
公钥加密算法

Public key cryptography solves the logistical problem of key distribution by using both a public key and a private key. The public key can be sent openly through the network while the private key is kept private by one of the communicating parties. The public and the private keys are cryptographic inverses of each other; what one key encrypts, the other key will decrypt.
公钥加密解决不管是用公钥还是私钥过程中的密钥分发这个逻辑性问题。当私钥被一个通信实体拥有之后他的公钥可以在网络之间公开的传播。公钥和私钥可以彼此进行加密和解密。当用一种钥加密的时候，另一端可以用另外一种密钥解密。公钥加密私钥解密，或者私钥加密公钥解密。

Let’s assume that Bob wants to send a secret message to Alice using public key cryptography. Alice has both a public key and a private key, so she keeps her private key in a safe place and sends her public key to Bob. Bob encrypts the secret message to Alice using Alice’s public key. Alice can later decrypt the message with her private key.
让我们假定小明要用公钥加密发送密文给小红，小红既有自己的公钥和私钥，她把她自己的私钥放在一个安全的地方，并且发送她的公钥给小明，小明于是用小红的公钥加密要发送的内容，小红可以用自己的私钥进行解密。

If Alice encrypts a message using her private key and sends the encrypted message to Bob, Bob can be sure that the data he receives comes from Alice; if Bob can decrypt the data with Alice’s public key, the message must have been encrypted by Alice with her private key, and only Alice has Alice’s private key. The problem is that anybody else can read the message as well because Alice’s public key is public. While this scenario does not allow for secure data communication, it does provide the basis for digital signatures. A digital signature is one of the components of a public key certificate, and is used in SSL to authenticate a client or a server. Public key certificates and digital signatures are described in later sections.
如果小红用自己的私钥加密内容发送给小明，小明当然可以收到来自小红的内容，小明可以用小红的公钥来解密内容，由于这些内容被小红用自己的私钥进行了加密，尽管只有小红有小红的私钥，但是这样做的问题是任何人都能读取到小红的信息，因为小红的公钥是公开的。当然这个情景不被用在安全信息的交互中，只是用在提供基本的数字签名上面。一个数字签名是一份公开密钥证书的一部分，这会用在SSL的client和server的身份认证当中。公钥证书和数字签名我们过会再谈。

Public key cryptography is also called asymmetric cryptography because different keys are used to encrypt and decrypt the data. A well known public key cryptographic algorithm often used with SSL is the Rivest Shamir Adleman (RSA) algorithm. Another public key algorithm used with SSL that is designed specifically for secret key exchange is the Diffie-Hellman (DH) algorithm. Public key cryptography requires extensive computations, making it very slow. It is therefore typically used only for encrypting small pieces of data, such as secret keys, rather than for the bulk of encrypted data communications.
公钥加密也被成为非对称加密，因为他们在加密和解密过程中使用不同的密钥。比较知名的在SSL中常用的公钥加密算法是RSA算法，另外一个在SSL中比较特殊的用来密钥交换的DH算法，公钥加密需要消耗很多计算资源，计算很慢。因此典型的用法是用来加密小片数据，比如密钥，而不是大量的数据。

A Comparison Between Secret Key and Public Key Cryptography
Both secret key cryptography and public key cryptography have strengths and weaknesses. With secret key cryptography, data can be encrypted and decrypted quickly, but since both communicating parties must share the same secret key information, the logistics of exchanging the key can be a problem. With public key cryptography, key exchange is not a problem since the public key does not need to be kept secret, but the algorithms used to encrypt and decrypt data require extensive computations, and are therefore very slow.
比较一下公钥加密和私钥加密的优缺点，用私钥加密，数据可以快速的被加密，但是因为通信双方必须分享他们的密钥信息，密钥交换这是一个问题。用公钥加密密钥交换不是问题，因为公钥可以不需要保持保密状态，但是加密和机密的过程要耗费很多资源并且比较慢。

Public Key Certificates
A public key certificate provides a safe way for an entity to pass on its public key to be used in asymmetric cryptography. The public key certificate avoids the following situation: if Charlie creates his own public key and private key, he can claim that he is Alice and send his public key to Bob. Bob will be able to communicate with Charlie, but Bob will think that he is sending his data to Alice.

公钥证书
公钥证书为一个实体在非对称机密过程中提供了一中安全的传递公钥的方法 ，公钥证书避免了一下几种情况：如果小黑创建了他自己的公钥和私钥，他可以宣称他就是小红然后发送给小明，小明因此就和小黑通信了，但是小明还以为他正在给小红发信。

A public key certificate can be thought of as the digital equivalent of a passport. It is issued by a trusted organization and provides identification for the bearer. A trusted organization that issues public key certificates is known as a certificate authority (CA). The CA can be likened to a notary public. To obtain a certificate from a CA, one must provide proof of identity. Once the CA is confident that the applicant represents the organization it says it represents, the CA signs the certificate attesting to the validity of the information contained within the certificate.
一个公钥证书可以被认为是由一个可信的专门为持有人提供身份认证的组织发布的数字护照。比较知名的可信的公钥证书颁布组织是CA，CA就像一个公证人。一个人必须地宫一些列的身份证明给CA ，CA才能给他颁布证书。一旦CA有信心申请代表一个组织，这个CA签署并且通过证书里面包含的信息验证这个证书的真实性。

A public key certificate contains several fields, including:
一个公钥证书里面包含很多内容：

Issuer - The issuer is the CA that issued the certificate. If a user trusts the CA that issues a certificate, and if the certificate is valid, the user can trust the certificate.
发布者 - 发布者是颁布这个证书的CA，如果一个用户相信这个CA并且这个证书是有效的，那么用户就可以使用这个证书。

Period of validity - A certificate has an expiration date, and this date is one piece of information that should be checked when verifying the validity of a certificate.
有效期 - 一个证书有过期的那天 ，这个时期可以被用来验证这个证书是不是个有效的证书。

Subject - The subject field includes information about the entity that the certificate represents.
主题 - 主题包括这个实体的证书主题信息。

Subject’s public key - The primary piece of information that the certificate provides is the subject’s public key. All the other fields are provided to ensure the validity of this key.
主题的公钥 - 这是公钥证书的主要信息。所有的其他信息都是为了保证这个公钥的有效性。

Signature - The certificate is digitally signed by the CA that issued the certificate. The signature is created using the CA’s private key and ensures the validity of the certificate. Because only the certificate is signed, not the data sent in the SSL transaction, SSL does not provide for non-repudiation.
签名 - 这个证书被相信这个证书的CA 做了数字签名，这个签名是由CA的私钥做的签名，为的就是保证这个证书的有效性。因为只有证书被签名，**，SSL不提供不可抵赖性的检查。

If Bob only accepts Alice’s public key as valid when she sends it in a public key certificate, Bob will not be fooled into sending secret information to Charlie when Charlie masquerades as Alice.
如果小明只接受了小红发来的有效的公钥，这样小明就不会再发保密的信息给小黑，被小黑愚弄以为小黑就是小红了。

Multiple certificates may be linked in a certificate chain. When a certificate chain is used, the first certificate is always that of the sender. The next is the certificate of the entity that issued the sender’s certificate. If there are more certificates in the chain, each is that of the authority that issued the previous certificate. The final certificate in the chain is the certificate for a root CA. A root CA is a public certificate authority that is widely trusted. Information for several root CAs is typically stored in the client’s Internet browser. This information includes the CA’s public key. Well-known CAs include VeriSign, Entrust, and GTE CyberTrust.
多个证书被链接在一个证书链中，当一个证书链被使用的时候，第一个证书通常是发送者。下一个证书是由发送者颁发的证书。如果链中还有其他证书，每一个证书都是通过它的上一个颁发者来进行验证。在证书链中最终的那个证书是根证书，rootCA， 典型的根证书通常被广泛的信任并且应用，很多根证书的信息被存在客户端的浏览器里，这些信息包括一个CA的公钥，比较知名的CA 包括VeriSign,Entruse, 还有GTE CyberTrust.

Cryptographic Hash Functions
密码hash作用

When sending encrypted data, SSL typically uses a cryptographic hash function to ensure data integrity. The hash function prevents Charlie from tampering with data that Alice sends to Bob.
当发送一个加密数据时，SSL通常使用密码hash来保证数据的完整性，哈希的作用是防止小黑在小红发给小明数据的过程中截取数据。

A cryptographic hash function is similar to a checksum. The main difference is that while a checksum is designed to detect accidental alterations in data, a cryptographic hash function is designed to detect deliberate alterations. When data is processed by a cryptographic hash function, a small string of bits, known as a hash, is generated. The slightest change to the message typically makes a large change in the resulting hash. A cryptographic hash function does not require a cryptographic key. Two hash functions often used with SSL are Message Digest 5 (MD5) and Secure Hash Algorithm (SHA). SHA was proposed by the U.S. National Institute of Science and Technology (NIST).
一个密码Hash 函数，就像做一个检验，两者之间主要的不同时 checksum 的设计初衷是为了发现数据中异常的改变。密码摘要（hash）的设计目的是为了检测故意的数据改变。密码摘要是把一个很短的字符串转换成一个很长的hash 字符串，在这个过程中，不需要密钥。SSL里面主要支持两种hash算法，MD5和SHA，SHA是由美国NIST组织提出的。

Message Authentication Code
信息校验码

A message authentication code (MAC) is similar to a cryptographic hash, except that it is based on a secret key. When secret key information is included with the data that is processed by a cryptographic hash function, the resulting hash is known as an HMAC.
一个信息校验码(MAC)类似于hash 摘要，除了MAC是基于各种密钥的，当一个由hash 函数摘要包含了数据和密钥信息，这个结果就可以被认为是HMAC。

If Alice wants to be sure that Charlie does not tamper with her message to Bob, she can calculate an HMAC for her message and append the HMAC to her original message. She can then encrypt the message plus the HMAC using a secret key she shares with Bob. When Bob decrypts the message and calculates the HMAC, he will be able to tell if the message was modified in transit. With SSL, an HMAC is used with the transmission of secure data.
如果小红想确定小黑没有篡改她发给小明的信息，他可以计算他的HMAC信息并且付上HMAC的原始信息。她可以用密钥加密这些信息附上HMAC，一起发送个小明，小明收到信息之后解密这些信息，然后重新对原始信息做HMAC，如果HMAC是和刚刚解密的内容是一致的那么就证明在传输过程中没有改变。一个HMAC被用来保证传输过程中的数据安全。

Digital Signatures
Once a cryptographic hash is created for a message, the hash is encrypted with the sender’s private key. This encrypted hash is called a digital signature.
数字签名
一旦密码hash 在一个信息上计算出来，这个hash的结果被发送者的私钥加密，这个加密完的hash值就被成为数字签名。

The SSL Process
SSL的工作过程
Communication using SSL begins with an exchange of information between the client and the server. This exchange of information is called the SSL handshake.
SSL的交互以客户端和服务器端的信息交换开始的，这个信息交换成为握手。

The three main purposes of the SSL handshake are:
Negotiate the cipher suite
Authenticate identity (optional)
Establish information security by agreeing on encryption mechanisms
SSL握手包含以下三个主要的目的:
协商密码集
验证实体
通过协商的加密机制建立安全信息通道

Negotiating the Cipher Suite
The SSL session begins with a negotiation between the client and the server as to which cipher suite they will use. A cipher suite is a set of cryptographic algorithms and key sizes that a computer can use to encrypt data. The cipher suite includes information about the public key exchange algorithms or key agreement algorithms, and cryptographic hash functions. The client tells the server which cipher suites it has available, and the server chooses the best mutually acceptable cipher suite.
协商密码集
SSL回话将开始会在客户端和服务器端协商那个密码集会被使用，一个密码集簇是一系列的密码算法和密钥大小的约定，这些页顶将会应用到接下来的数据加密中。密码集簇主要包括公钥交换的算法，或者密钥使用的算法，密码哈希函数。客户端会告诉服务端哪个密码集簇会被使用，服务端选择最合适的可以被接受的密码簇。

Authenticating the Server
In SSL, the authentication step is optional, but in the example of an e-commerce transaction over the Web, the client will generally want to authenticate the server. Authenticating the server allows the client to be sure that the server represents the entity that the client believes the server represents.
服务端验证
在SSL中服务端验证是可选的，但是比如在web的电子交易中，客户端通常会验证服务端。服务端的验证允许客户端确保服务端的实体身份以致客户端能够完全信任服务端。

To prove that a server belongs to the organization that it claims to represent, the server presents its public key certificate to the client. If this certificate is valid, the client can be sure of the identity of the server.
为了证明服务器端属于他所宣称的那个客户端，server端必须展示他的公钥证书给他的客户端。如果证书是被验证的，客户端将能确定这个服务端的身份。

The client and server exchange information that allows them to agree on the same secret key. For example, with RSA, the client uses the server’s public key, obtained from the public key certificate, to encrypt the secret key information. The client sends the encrypted secret key information to the server. Only the server can decrypt this message since the server’s private key is required for this decryption.
客户端和服务器端允许他们之间使用相同的密钥。比如RSA中，客户端使用从服务器端的公钥证书中提取的公钥，加密决定在通信中使用的密钥信息，客户端发送这个加完密的密钥信息给服务端，只有服务端拥有服务端证书的私钥并能解密这些信息。

Sending the Encrypted Data
Both the client and the server now have access to the same secret key. With each message, they use the cryptographic hash function, chosen in the first step of this process, and shared secret information, to compute an HMAC that they append to the message. They then use the secret key and the secret key algorithm negotiated in the first step of this process to encrypt the secure data and the HMAC. The client and server can now communicate securely using their encrypted and hashed data.

发送加密数据
直到现在客户端和服务器端都已经可以使用相同的密钥了，他们使用第一步中协商的密码hash算法 计算HMAC 并且附在信息后面，然后再用协商出来的密钥算法加密这些安全数据和HMAC，至此，客户端和服务器端可以使用安全的加密和hash 数据了。

The SSL Protocol
The previous section provides a high-level description of the SSL handshake, which is the exchange of information between the client and the server prior to sending the encrypted message. This section provides more detail.

SSL 协议
前面的章节主要宏观的介绍了SSL的握手协议，主要包括了客户端和服务器端之间怎么交换信息和发送加密数据的。下面的部分将提供更为详细的介绍：

The “SSL Messages” figure below shows the sequence of messages that are exchanged in the SSL handshake. Messages that are only sent in certain situations are noted as optional. Each of the SSL messages is described in the following figure:
SSL 消息图显示了SSL握手中信息交互的序列，每个SSL消息如下图的描述：

1.Client hello - The client sends the server information including the highest version of SSL it supports and a list of the cipher suites it supports. (TLS 1.0 is indicated as SSL 3.1.) The cipher suite information includes cryptographic algorithms and key sizes.
1.客户端 hello - 客户端发给服务器端的信息包含他能支持的最高版本的SSL协议的密码集合，这个密码集合包括密码算法和密钥长度。

2.Server hello - The server chooses the highest version of SSL and the best cipher suite that both the client and server support and sends this information to the client.
2.服务端 hello - 服务端选择他所支持和客户端所共同支持的最高版本的密码集合给客户端。

3.Certificate - The server sends the client a certificate or a certificate chain. A certificate chain typically begins with the server’s public key certificate and ends with the certificate authority’s root certificate. This message is optional, but is used whenever server authentication is required.
4.证书 - 服务端发送给客户端证书或者一个证书链。一个典型的证书链通常以服务端的公钥证书开始并以证书的根证书结尾。这个信息可以是可选的，但是当要求服务器端认证的时候则是必须的。

4.Certificate request - If the server needs to authenticate the client, it sends the client a certificate request. In Internet applications, this message is rarely sent.
4.证书请求 - 如果服务器端需要验证客户端，服务器就会发送一个证书请求给客户端，在网络环境中，这个过程通常很少使用。

5.Server key exchange - The server sends the client a server key exchange message when the public key information sent in 3) above is not sufficient for key exchange.
5.客户端密钥交换 - 服务器发送给客户端服务端的密钥交换信息，当第三步中的信息不够的时候。

6.Server hello done - The server tells the client that it is finished with its initial negotiation messages.
6.服务端hello完成 - 服务端告诉客户端 ，完整的协商信息已经完成。

7.Certificate - If the server requests a certificate from the client in Message 4, the client sends its certificate chain, just as the server did in Message 3.
Note: Only a few Internet server applications ask for a certificate from the client.
7.证书 - 如果在第四步中服务器端需要客户端的证书信息，客户端会发送证书链给服务端，就像在第三步中服务端发送信息给客户端一样。 注意：只有很少一部分程序会要求客户端发送证书信息。

8.Client key exchange - The client generates information used to create a key to use for symmetric encryption. For RSA, the client then encrypts this key information with the server’s public key and sends it to the server.
8.客户端密钥交换 - 客户端生成信息为后面的系统性加密创建密钥。对RS来讲，客户端用服务端的公钥加密这些信息并发送给服务端。

9.Certificate verify - This message is sent when a client presents a certificate as above. Its purpose is to allow the server to complete the process of authenticating the client. When this message is used, the client sends information that it digitally signs using a cryptographic hash function. When the server decrypts this information with the client’s public key, the server is able to authenticate the client.
9.证书验证 - 当客户端要求如上信息的时候。他的目的是允许服务端完成验证客户端的过程。当这些信息应用的时候，客户端用他们的密码哈希函数签名发送出去，当服务端收到这些信息并用客户端的公钥解开，服务器端也验证了客户端。

10.Change cipher spec - The client sends a message telling the server to change to encrypted mode.
10 .改变密码spec - 客户端发送信息告诉服务端改变加密模式。

11.Finished - The client tells the server that it is ready for secure data communication to begin.
11.完成 - 客户端告诉服务端 可以安全的发送数据信息了

12.Change cipher spec - The server sends a message telling the client to change to encrypted mode.
12.改变密码spec - 服务器端发送信息告诉客户端改变加密模式。

13.Finished - The server tells the client that it is ready for secure data communication to begin. This is the end of the SSL handshake.
13.完成 - 服务器告诉客户端已经可以安全的发送信息了。此时SSL握手结束。

14.Encrypted data - The client and the server communicate using the symmetric encryption algorithm and the cryptographic hash function negotiated in Messages 1 and 2, and using the secret key that the client sent to the server in Message 8.
14.加密数据 - 客户端和服务器端用在1 、2步中协商的加密算法和hash函数还有密钥，发送数据

15.Close Messages - At the end of the connection, each side will send a close_notify message to inform the peer that the connection is closed.
15.关闭信息 - 在链接的最后，服务端和客户端 将会发送 关闭信息 对每个链接方来关闭链接。

If the parameters generated during an SSL session are saved, these parameters can sometimes be re-used for future SSL sessions. Saving SSL session parameters allows encrypted communication to begin much more quickly.
如果在SSL回话过程中生成的参数是被保存的，这些参数有时候可以重新应用于将来的SSL会话当中，保存SSL 会话参数将会使加密通信变得非常快速。