SSL/TLS protocol overview

AN4683

10/31

DocID027745 Rev 1

Figure 4. Certificate chain or chain of trust

In some cases it would be easier and less expensive to use self-signed certificates, for

example, for testing purposes or when the parties know and trust each other. A self-signed

certificate is a certificate that is signed by the same entity whose identity it certifies. There is

no central CA.

TLS supports three authentication modes:

–

Mutual authentication - both parties (client and server) share their signed

certificates and authenticate each other. Mutual authentication provides stronger

security by assuring that the identity on both sides of the communication are

known.

–

One-way authentication - only the server sends its signed certificate and is

authenticated by the client. The client is not required to send the server a digital

certificate and remains unauthenticated (no certificate).

–

Anonymous - neither entity authenticates the identity of the other party.

Each party is responsible for verifying that the other’s certificate is valid and has not expired

or been revoked. In case of one-way or mutual authentication, because certificate validation

requires that root CA keys be distributed independently, it is assumed the remote end must

already possess a root CA certificate to accomplish validation.