If it supports SSL, the server responds by sending back its own Hello message and the selected encryption and compression methods, including its certificate, along with some random numbers used later in the protocol. The client checks the certificate from the server to see if the common name stored in the certificate matches the name of the server it has connected to-and verifies the certificate is valid. The client now sends along its own random value and, depending on the key exchange protocol chosen, either an encrypted secret or values used to determine that secret. The server may also request a certificate from the client, to authenticate the user of the browser. If negotiations are successful, the browser sends the Web server a Finished message, the server responds with its own Finished message, and both exchange encrypted and digitally signed data.
Key exchange takes a long time in computer terms.
The SSL protocol includes a feature to reduce the number of necessary key exchanges. If a Web browser makes another connection to the same SSL-enabled server, it can send a session identifier, and if the server accepts the identifier, it will use the previously negotiated encryption and compression algorithms and the current key. Netscape browsers can also include a keep alive request, so that even after data has been exchanged, the TCP connection remains open for some time and can be used for future transactions without further negotiations. Achilles' Heels One of the most common problems with SSL concerns key length. Short keys can be brute forced, that is, guessed by trying all possible key combinations.