Download PDF - IBM Redbooks

The steps in bold in Figure 5-6 on page 95 are additional steps specific to client
certificate authentication:
1. The client sends a client hello command to the server, which includes:
– Client version - highest SSL and TLS version supported by the client
– Random structure generated by the client for use in the key generation
process
– A session ID that the client wishes to use for the connection
– Ciphers supported by the client with client's first preference first
– Data compression methods supported by client sorted by client preference
2. The server sends a server hello command to the client, which includes:
– Highest client SSL or TLS version that server supports
– Random structure generated by the server for use in the key generation
process
– A session ID for the SSL session
– A cipher selected by the server from the list of client-supported ciphers
– Data compression method selected by the server from the list of
client-supported compression methods
3. The server sends the server certificate (that is, the X.509 certificate).
4. The server sends a certificate request to authenticate the client. This step
occurs with client certificate authentication only.
5. The server sends the server hello done, indicating that the server is done
sending messages to support the key exchange. The client should verify that
the server provided a valid certificate upon receiving the server hello done.
6. The client sends a client certificate only if the server requested a certificate.
This step occurs with client certificate authentication only.
7. The client key exchange occurs using a premaster secret that was created by
the client and was then encrypted using the server’s public key.
Both the client and the server generate the symmetric encryption keys on
there own using the premaster secret and the random data that is generated
from the server hello and client hello commands.
8. The certificate verify message is sent to provide explicit verification of a client
certificate. This step occurs with client certificate authentication only.
9. The change cipher spec message is sent by the client to notify the server that
subsequent records will be protected under the newly negotiated CipherSpec
and keys.
96 Security in WebSphere Application Server Version 6.1 and J2EE 1.4 on z/OS