A quick guide on what a two way SSL certificate does and how you can use it for mutual authentication

An SSL/TLS certificate is used to secure the data transmission between a user’s browser and the website’s server. When most people talk about these certificates, they’re referring to server certificates, which are used to authenticate servers to clients. However, what if you need to perform client authentication, meaning that you want to authenticate the client to the browser? This is where two way SSL certificates (or “2 way SSL”) come in handy.

Why would I need to use this other type of certificate? Because when both of these types are certificates are used, it facilitates mutual authentication between both parties.

There is one very important thing to know: Unlike a standard SSL certificate, a two way SSL certificate is actually known as a personal authentication certificate (PAC).

But before we jump into exploring the meaning of both of these SSL types, you first must be familiar with how the HTTPS connection is made. So, let’s have a quick review:

How SSL Authentication Works (A Brief Overview)

• The website owner buys an SSL certificate for their domain name(s) and sends an unsigned certificate with their public keys to the certificate authority (CA).
• The CA verifies the identity and domain ownership of the applicant by following a validation process. After successful validation, the CA issues an SSL certificate for the domain, ties the server’s public key to the certificate and signs it with its own intermediate root certificate.
• When a browser (client) tries to connect to a website, the SSL handshake process takes place.
• Once the SSL handshake process is over, the browser generates a session key and encrypts it using the public key attached in the server’s SSL/TLS certificate.
• The session key reaches to the server. The server decrypts it using the corresponding private key.
• Now, this session key is used for encrypting and decrypting all the data transferred between a server and the browser. 

The reason we have highlighted the word “SSL handshake process” here is because in the one-way SSL and the 2 way SSL, only the type of certificate that’s used and the SSL handshake process itself differs. All the other steps remain the same.

Now that you know the basics, let’s proceed further to explore the meaning, working style, and usage of the one-way SSL and two way SSL authentication processes.

How One-Way SSL Authentication Works with a Traditional SSL/TLS Certificate

Let’s start with the SSL certificate you’re most familiar with. In all the communications, there are two endpoints involved, the browser and the website it’s connecting to (i.e., a client and server). In one-way SSL authentication, only the identity of one endpoint — the server — is verified. When you try to open a website, your browser authenticates the legitimacy of the website’s server by checking the site’s SSL certificate. One-way SSL certificates are also known as server authentication certificates.

Let’s understand how the SSL handshake process takes place in one-way SSL authentication:

1. When a user attempts to connect to a website on their web browser, the browser tries to establish an HTTPS connection to the website’s server. It sends the supported cipher suites to the server in the ClientHello process.
2. The server responds by sending its public certificate (i.e., the SSL/TLS certificate) to the browser.
3. The browser checks whether the certificate is legitimate (i.e., not expired or revoked), supporting the latest algorithms, properly configured, etc.
4. After that, the browser checks the validity of the CA’s signature from its pre-installed root store.
5. If everything seems fine, the SSL handshake process completes, and the browser generates the session key.

As you read above in the entire SSL handshake process, only the server’s SSL certificate is verified. Basically, this process enables the browser to ensure that it’s connecting to the right website’s server, and that all of the data is routed to the intended site only via a secure connection.

Now, let’s move to the next type of authentication to understand how the 2 way SSL authentication process differs from one-way SSL.

How Two Way SSL Authentication Works with a Personal Authentication Certificate

In two way SSL, both the client and the server’s identities are verified during the SSL handshake process. That’s why they’re also known as mutual authentication SSL certificates. Now, let’s explore how the SSL handshake differs in the 2 way SSL handshake process:

1. When a user tries to connect with a website on their web browser, the browser tries to establish an HTTPS connection to the website’s server. It sends the supported cipher suites to the server in the ClientHello process.
2. The server responds by sending its public certificate i.e., the SSL/TLS certificate to the browser.
3. The browser checks whether the certificate is legitimate i.e., not expired or revoked, supporting the latest algorithms, properly configured, etc. 
4. After that, the browser checks the validity of the certificate authority’s signature from its pre-installed root store.
5. Once it successfully verifies the server, the client (browser) itself sends its public certificate to the server.
6. The server verifies the validity and the CA’s signature of the browser’s certificate.
7. If everything seems fine, the SSL handshake process completes, and the browser generates the session key.

As you can see, in the two way SSL certificate, there are two additional steps involved in the SSL handshake process, which we have highlighted in the red color above.

2 way mutual SSL authentication requires the use of:

• A private key,
• A personal authentication certificate,
• A CA’s root certificate, and
• A CA’s intermediate certificate (though not necessarily required in all cases)

Once the client verifies the server’s identity, the server gets a chance to verify the client’s identity, too. Here, both parties have their own separate SSL certificates, which must be signed by the publicly trusted certificate authority.

Uses of a 2 Way SSL Certificate

Two way SSL certificate authentication is also known as mutual authentication. In a server certificate, the server’s identity is verified during the initial SSL handshake. Two way SSL certificate authentication is a method where a client’s identity is also verified during the initial SSL handshake. Therefore, the two way handshake involves the authentication of both client and server.

So now that you know how the SSL handshake process differs between one-way SSL and two way SSL, the next question would arise, why is a two-way certificate necessary? A two-way certificate is used by the websites to select which clients can interact with it securely.

For example, an organization’s intranet website typically exists for their employees to access information and communicate on official matters. The organization doesn’t want anyone else to access such an internal website and would like to restrict the audience. Moreover, the employees should be accessing that website from their official devices only to further mitigate the risk of unsolicited access.

In such cases, the organization can use a two-way SSL certificate to authenticate the clients before letting them access the website. Companies also can use it to weed out the cybercriminals and bots from entering their sites.

Conclusion

2 way certificates are generally used in the organizations for the internal communication. For example, when you have an S/MIME or personal authentication certificate on all of your employees’ devices, no one can intercept and read the communication between the two endpoints. As far as SSL certificates are concerned, some organizations use it to block some particular user or website visitors from a particular geographical location. In either way, a two way SSL or any other 2 way certificates like S/MIME provide a robust security to your internal and external communications.  

Email signing certificates (also known as S/MIME certificates) are used to digitally sign and encrypt the email messages that you send from your mailbox. Not only do these certificates ensure confidentiality but also determine the integrity of the messages. Only the intended recipient can decrypt and read the mail and ascertain that it hasn’t been tampered with by an attacker on the network.

Outlook Security Certificate

An outlook security certificate is a digital certificate used in Microsoft Outlook to sign the emails so that the receiver can be sure that the email has actually come from a legitimate person and has not been intercepted or altered by any other person. It uses the public key infrastructure (PKI) to encrypt and decrypt the communication. An outlook security certificate is also called S/MIME or email certificate. It’s a digital certificate used in Microsoft Outlook to sign the emails so that the receiver can be sure that the email has actually come from a legitimate person and has not been intercepted or altered by any other person.

Outlook 2010 Install Certificate

If you use Outlook 2010, installing an email certificate is very simple. This article is your comprehensive guide to install email certificates on Outlook. It also features screenshots to make it easier for you to install the certificate.

Secure Email Certificate Outlook 2016

A secure email certificate for Outlook 2016 helps you to fulfill three basic functions:

• Validates the identity of the sender
• Encrypts the email while in transit for confidentiality
• Maintains the integrity of the email

Let’s see how to install a certificate for sending out an encrypted email in Outlook.

Prerequisites

1. Your email signing certificate

Download and save the PKCS#12 file (i.e., your email signing certificate) on your local machine and ensure that you remember the file path.

2. Your password

When saving your certificate file, you were asked to enter a password. Keep the password securely as it will be required during the installation process mentioned below.

How To Install Encryption Certificate In Outlook

Follow the simple steps mentioned below to install an encryption certificate in Outlook:

• Go to ‘File’ then click on ‘Options’

• Once the ‘Outlook Options’ window pops up, navigate to ‘Trust Center’ and select ‘Trust Center Settings.’

• On the ‘Trust Center’ window navigate to the tab labeled ‘Email Security.’

• On the right pane, under the Digital IDs (Certificates) tab, click on ‘Import/Export.’

• On the ‘Import/Export Digital ID’ window that opens up select the ‘Import existing Digital ID from a file’ option.

• Click on ‘Browse’ and navigate to the location on your PC where the file is stored and click on ‘Open.’ The file path should now be filled in the ‘Import File’ field.

• Enter the password that you used when downloading file and then click ‘OK.’

• On the dialogue box that pops up, click ‘OK.’

• Under ‘Email Security’ select ‘Settings.’

• Once the ‘Change Security Settings’ window pops up, enter the name for your security settings.

• Under ‘Certificates and Algorithms’ next to the ‘Signing Certificate’ field click on ‘Choose’ to load your certificate and then click ‘OK’ on the confirm certificate window.

• Repeat for the ‘Encryption Certificate’ field and if you have more than one, select the same certificate as you did for the previous step.
• Click ‘OK’ and once the ‘Change Security Settings’ window closes, select the default options you want via the four checkboxes under the ‘Encrypted email’ tab.

• Once you click ‘OK’ to close the ‘Trust Center Window’, your certificate is installed and ready to be used!

A secure email certificate, also known as an S/MIME certificate or an email signing certificate, is used by anyone who sends emails for business-related purposes that contain sensitive information. It’s widely used by small businesses, SMBs, and large corporations because it does two extraordinary things:

1. It attaches a digital signature to the email that verifies that you (and not an imposter) sent the email, and that the email hasn’t been altered since it was sent.
2. It encrypts your emails before they ever leave your mailbox so they can only be opened by your intended recipients. This provides both data in-transit and data at-rest protection.

Let’s understand each of the above-stated functions in detail.

A Digital Signature Warns Users Whether an Email Has Been Altered

When you install a secure email certificate on your email server (such as Microsoft Outlook, Apple Mail, Mozilla Thunderbird, etc.), it automatically attaches your digital signature to all of your outgoing emails. This digital signature is encrypted and produces a unique hash value. If anyone tries to alter this digital signature, the hash value changes. This warns the sender and recipient that something about the email is fishy.

Essentially, the encrypted digital signature assures the recipient that your email is valid, and it was sent by you/your company and is not a phishing email.

End-to-End Email Encryption: Protects Data in Transit and At Rest  

End-to-end email encryption means that your emails are protected from one end of the transaction to another. This means that before you even hit “send,” your email is encrypted. A secure email certificate encrypts the entire content of the email until the email reaches the intended recipient’s inbox and is decrypted. So, if anyone breaks into the email network, all they would see is a bunch of random numbers and letters, which won’t be of use to them! That’s because the actual message can be decrypted and read only by the intended recipient through the use of public key encryption.

In other words, a secure email certificate helps to ensure that your email contents arrive in the same condition as they were sent. Nothing is added, deleted, or altered while the email was in the transit.

If both the sender and recipient have installed a secure email certificate on their individual endpoints, all the signed emails stored and archived on the recipient’s email server also stay encrypted.

Why Email Encryption Matters

Okay, so encrypting your email and signing it with a digital signature sounds great. But what’s the real value to your organization? There are three crucial reasons as to why you should install a secure email certificate on your endpoint devices:

Protect Your Organization’s Reputation

It’s commonly said that you only get one chance to make a first impression. The same can frequently be said about an organization’s reputation. A data breach or other cybersecurity issue can result in costly reputational damage for your organization. And once you lose that trust — well, it’s hard to get it back.

It’s a common phishing practice to insert harmful scripts, links, and other sorts of dangerous malware into emails. When cybercriminals get access to any company’s email network, they use authentic emails sent by the authorize employees and corrupt them. The recipient thinks that the email was sent by a trusted organization. As a result, they open the email, click on the link, download the attachment, fill out the form, or share confidential details. That’s how they become the victim of various cybercrimes. 

On the other end, you —as the business organization — have no clue about it, and yet your reputation is getting harmed as a result.

Below is a screenshot of an email that’s been digitally signed by a secure email certificate. The small ribbon icon on the right site is a symbol of the encrypted email. When you click on that ribbon icon, you would see a window assuring the authenticity of the sender and the content of the email.  

Secure Sensitive and Confidential Information

Companies frequently send, receive, and store confidential information on emails. These details could be:

• trade secrets,
• customer lists,
• stakeholders’ PII (personally identifiable information),
• financial details,
• conversation with customer care department, or
• Information related pricing, discounts, costs, and profits, etc.

All of these details are virtual goldmines for hackers. They can use these types of information or sell them to your competitors, other cybercriminals, or even the media (if anything is controversial) and make tons of money from your misfortune.

But when you use a secure email certificate, you encrypt the contents and attachments of your emails, which allows you to protect them while they’re in transit or stored on email servers. Plus, a secure email certificate doesn’t cost you an arm and a leg! You can get it for as low rate as $12.95/year from SectigoStore.com!

Compliance with Regulations and Laws

Regulations such as the Payment Card Industry Data Security Standard (PCI DSS), Healthcare Insurance Portability and Accountability Act (HIPAA), and the European Union’s General Data Protection Regulation (GDPR) have outlined recommendations and/or requirements about securing sensitive information when sending it via email. 

How Does a Secure Email Certificate Work?

An email signing certificate works on public key infrastructure (PKI).

All the email addresses that use a secure email certificate have a set of asymmetric keys i.e. a public and it’s corresponding private key. As the name suggests, the public key is available to publicly, meaning that anyone can access it. The public key is used to encrypt the email’s contents.

The encrypted email travels via insecure internet and reaches to the recipient’s server.

Now, the role of the private key starts. The private key is safely stored on the email recipient’s server. When the content of the email is encrypted using a public key, only its corresponding private key can decrypt it.

The internet is likely always going to be insecure. Without encryption, anyone could potentially get access to your email messages and their contents. But when your emails are encrypted, no one can read or modify them until they reach the intended party.  

Sectigo Secure Email Certificate

There are many certificate authorities (CAs) in the market selling secure email certificate. Among them, Sectigo is the market leader in cybersecurity products such as SSL/TLS certificates, document signing certificates, and email signing certificates. Sectigo is just a newer brand name for the industry titan Sectigo (formerly Comodo CA). SectigoStore.com is the platinum partner of Sectigo. So, if you buy your Sectigo secure email certificate from us, you can get as much as a 20% discount on the retail price!