The following are SSL interview questions and answers which is ideal for candidates aspiring for networking, web programming, cloud networking and security job interviews.
1. Does http use SSL protocol
No. http is an insecure protocol which does not use any security protocol.
2. Which transport layer protocol does SSL use for communication and the respective port number.
SSL uses TCP for communication. The port number used is 443.
3. Does SSL communication take place before or after the establishment of TCP 3 way connection between the client and the server
SSL communication happens after the TCP 3 way handshake.
4. Where are the keys saved for encrypting the data between the client and the server in a SSL communication.
The keys are not saved. They are created dynamically by the client and the server by exchanging appropriate messages.
5. How does the client and the server start a SSL communication
The client initiates a TCP 3 way handshake with the server on port number 443. Port 443 is the port number of SSL.
6. A web server is behind a firewall. A client is communicating with the web server using SSL. Can the firewall view the data packets in clear text
This would not be possible since the data which is encrypted by the client can only be decrypted by the server, since the session keys used for encryption and decryption is available only to the client and the server and not the firewall.
7. How does a client authenticate a web server during SSL communication
The server sends the client a server certificate which is digitally signed by a certificate authority. When the client receives the certificate, it verifies the digital signature on the certificate.
8. Does http and SSL use the same port number
No. http uses TCP port 80 and SSL uses 443.
9. A hacker has cracked the wifi password of your network and is able to connect to any device on the network. Would he be able to view the data sent between a browser and a web server on your PC which is using SSL.
Although the hacker has cracked the wifi password, he does not have access to the SSL keys which are used for encrypting the data between the client and the server. So he would not be able to view the data.
10. In which message is the server random number sent as part of the SSL handshake.
The server random number is sent in the server hello message. This message is sent after the client has sent the client hello message.
11. What is the fundamental difference between IPSEC and SSL
IPSEC works at the network layer, but SSL works at the application layer.
12. How is the pre-master secret key sent from the client to the server
The pre-master secret key is sent encrypted using the servers public key. This is then decrypted by the server using its private key.
13. Which message in the SSL handshake indicates that the subsequent messages would be encrypted.
The change cipher spec message sent from the server to the client indicates that all subsequent messages would be encrypted.