Good articles to read on SSL and HTTPS?

Question

I had a problem with accepting invalid SSL certificate in my iPhone program. That problem is solved now, however I came to understanding that I have very abstract idea on how exactly the whole thing is working:

• how web browser is verifying that received certificate is really for host it communicates to and not faked by same party in the middle?
• if browser talks to some 3rd party (CA?) to do certificate check?

and many other questions... Would someone please recommend good source of information with in-depth enough description of how all parts click together?

Answer 1

Web Spoofing Revisited: SSL and Beyond

Answer 2

Plenty of detail here: The First Few Milliseconds of an https Connection

And the definitive book on the subject: SSL and TLS: Designing and Building Secure Systems

Answer 3

Check the articles here, specifically "Introduction to SSL" and "Building user authentication systems for client-server environments."

Answer 4

This is an excellent BlakHat talk on modern attacks against SSL: http://www.thoughtcrime.org/software/sslstrip/ Chrome recently introduced "Strict Transport Security" for https which partially addresses Moxie Marlen Spikes attacks.

Answer 5

Here is a basic introduction to SSL for developers: http://www.sslshopper.com/article-ssl-for-newbs.html

There is also much more information in the SSL FAQ on that site.