just want to ask/verify the process of verification

[Maaz]

Dear Experts
I wana ask some questions
if i have got a Digital(SSL) certificate from a Reputed CA e.g VeriSign, for my company's website, what will happen when someone will visit my companys website ?

Is it true that ?
when client(browser) access the webserver(website), webserver will provide/show the Certificate to the client... then client will aoutomatically check/verify the certificate from the CA(VeriSign) ?

then when the client found the website is trusted(by checking with the CA) ... the webserver will provide the randomly generated public key, to the client, so that all communication will be encrypted via the use of public key ?

I just want to verify the above, from u Experts.

Any help will be highly appreciated

Regards
Maaz

[Steven E. Protter · Accepted solution]

Besides the additional trust of having Verisign mentioned on it, there is little you get other than less money in your wallet.

The security of the data exchange would be no better or worse, in my opinion than if you generated a certificate yourself.

The liklihood of someone trusting and using your site might however be higher.

SEP

[Ivan Ferreira]

The client will automatically accept the certificate because VeriSign is an trusted CA in the browser.

About the ramdom public key, I think is the client who generate a ramdom symetric key and encrypt it with the public key of the server.

Communication will be encrypted always if they access using https://

See:

http://www.tldp.org/HOWTO/SSL-RedHat-HOWTO-2.html