The server will respond, and will contain the merchant's digital certificate, assuring the customer of the merchant's authentication. The customer's software examines the message, and then the customer creates a purchase order which will include the sensitive credit card information. The cardholder encrypts the purchase order with a single new key that is generated. Then the key is encrypted with the gateway's public key. Now only the gateway can read the single key and therefore decrypt the purchasing information.
Merchant receives the purchase order, and decrypts it, and authenticates the customer.
Now the merchant sends an authorization request message to the gateway. The gateway decrypts the information, and authenticates the merchant. Then it decrypts the purchase order, and authenticates the customer. The gateway now checks the company that issued the credit card. This ensures the card's validity and limit, and finalizes the purchase.