Ensures the identity of a remote computer.
Proves your identity to a remote computer.
I thought that the server certificate contains the public key of the server, thus ensuring its identity to the client.
Then how is it also able to ensure the client's identity?
What you see is not how the certificate is used but how the certificate can be used. This certificate can be used and also is used to authenticate a server against a client. It can also be used as a client certificate to authenticate a client against a server - although it is currently not used that way.
Using the same certificate for server and client authentication is useful in cases where a system/application can take both client and server roles. This is for example the case when transferring a mail between two mail servers or when SIP (VoIP) devices communicate with each other (a call might be created by both).
I connect to https://security.stackexchange.com and am sent their cert signed by Digicert Inc vouching that the cert- and the stackexchange's key I've been sent- belong to the domain stackexchange.com.
I use stackexchange's public key to encrypt data I'll send them to create symmetrical keys to encrypt our session. This ensures that the resulting keys are not compromised.
Only stackexchange can decrypt the data I sent them which was encrypted with their public key- they have the corresponding secret key.
Once the symmetrically key encrypted session has commenced, stackexchange's public key is no longer used.
SO: The result is a pair of symmetric keys: I have one, stackexchange has the same one. Since these keys were built using stackexchange's public key when passing the data, so when I now communicate with stackexchange, it could ONLY be me- unless stackexchange's secret key was somehow fatally compromised.
I could be sure stackexchange was stackexchange at the beginning of our interaction because Digicert endorsed their cert containing their public key. Stackexchange could be sure it was me because I used their Public key to safeguard the key material I passed to them to build the symmetrical keys using their trusted public key ensuring nobody in the middle could derive the symmetrical keys we would now be using.
Not the answer you're looking for? Browse other questions tagged tls web-application certificates server or ask your own question.
How are possible uses for X.509 (SSL) certificates denoted?