1 00:00:00,120 --> 00:00:01,290 In this demonstration, 2 00:00:01,290 --> 00:00:03,030 we're going to explore the digital certificates 3 00:00:03,030 --> 00:00:04,770 associated with a few websites 4 00:00:04,770 --> 00:00:06,420 and the type of information they contain 5 00:00:06,420 --> 00:00:08,700 in their public key certificates. 6 00:00:08,700 --> 00:00:11,070 On the screen, you see two websites. 7 00:00:11,070 --> 00:00:13,890 I have Google on the left and Apple on the right. 8 00:00:13,890 --> 00:00:15,390 Both of these are being visited 9 00:00:15,390 --> 00:00:19,470 over an HTTPS connection over port 443. 10 00:00:19,470 --> 00:00:23,430 If I click the little lock next to the website name, 11 00:00:23,430 --> 00:00:24,720 you're going to see that it does have 12 00:00:24,720 --> 00:00:26,850 a digital certificate and it's valid. 13 00:00:26,850 --> 00:00:28,350 Now in Chrome, if I click on that, 14 00:00:28,350 --> 00:00:30,960 it will give me the details of that certificate. 15 00:00:30,960 --> 00:00:35,010 Notice that the website certificate is for www.google.com. 16 00:00:35,010 --> 00:00:37,170 That's its public key certificate. 17 00:00:37,170 --> 00:00:40,470 It was issued by the Google Internet Authority G3 18 00:00:40,470 --> 00:00:42,000 and it was globally signed. 19 00:00:42,000 --> 00:00:43,920 Now, if I look at the details of this, 20 00:00:43,920 --> 00:00:45,870 I can see who the subject is. 21 00:00:45,870 --> 00:00:48,180 Who is the person this was issued to? 22 00:00:48,180 --> 00:00:51,390 This digital certificate was issued to Google LLC 23 00:00:51,390 --> 00:00:53,280 out of Mountain View, California. 24 00:00:53,280 --> 00:00:56,160 It was issued by Google Trust Services, 25 00:00:56,160 --> 00:00:57,960 which is one of the big online 26 00:00:57,960 --> 00:01:00,030 digital certificate providers. 27 00:01:00,030 --> 00:01:02,220 And you can see that it uses SHA-256 28 00:01:02,220 --> 00:01:04,050 to provide integrity of that signature 29 00:01:04,050 --> 00:01:06,660 and the encryption is using RSA. 30 00:01:06,660 --> 00:01:09,330 Now, as you go further, you can see what it's valid for. 31 00:01:09,330 --> 00:01:11,160 You can see the public key info. 32 00:01:11,160 --> 00:01:15,060 This is being sent as an ECC public key certificate 33 00:01:15,060 --> 00:01:19,320 and it has a key size of 256 bits. 34 00:01:19,320 --> 00:01:21,870 So I'm going to stop on that side and go look at Apple now. 35 00:01:21,870 --> 00:01:23,160 So if I go over here to Apple, 36 00:01:23,160 --> 00:01:25,950 you can see that this certificate was issued to Apple Inc. 37 00:01:25,950 --> 00:01:27,990 out of Cupertino, California. 38 00:01:27,990 --> 00:01:29,670 That's where Apple's headquarters is. 39 00:01:29,670 --> 00:01:31,590 If you scroll down, you'll see who issued it. 40 00:01:31,590 --> 00:01:33,330 It wasn't issued by Apple themself. 41 00:01:33,330 --> 00:01:36,150 It was issued by DigiCert, another large 42 00:01:36,150 --> 00:01:38,670 digital certificate, high assurance 43 00:01:38,670 --> 00:01:40,590 root certificate authority. 44 00:01:40,590 --> 00:01:43,680 Now you can also see when it was valid before and valid to. 45 00:01:43,680 --> 00:01:45,300 And as you scroll down a little bit further, 46 00:01:45,300 --> 00:01:48,180 you'll get the information on its public key information. 47 00:01:48,180 --> 00:01:52,020 So on the left with Google, we're using ECC, 48 00:01:52,020 --> 00:01:54,060 Elliptic Curve Cryptography. 49 00:01:54,060 --> 00:01:57,180 On the right, we're using RSA encryption. 50 00:01:57,180 --> 00:01:59,670 Now why is there a difference there? 51 00:01:59,670 --> 00:02:02,400 Well, Google has a very minimalist site 52 00:02:02,400 --> 00:02:06,240 and they also are focused very heavily on mobile browsers. 53 00:02:06,240 --> 00:02:09,449 Mobile devices have less processing power 54 00:02:09,449 --> 00:02:10,800 than a desktop would. 55 00:02:10,800 --> 00:02:12,300 And so if you're visiting a website 56 00:02:12,300 --> 00:02:14,850 and you're using a mobile browser, they try to send you 57 00:02:14,850 --> 00:02:18,210 an Elliptic Curve Certificate instead because 58 00:02:18,210 --> 00:02:21,630 with a smaller key size using only 256 bits, 59 00:02:21,630 --> 00:02:23,850 we still get a high level of security. 60 00:02:23,850 --> 00:02:26,610 Now, on the right, Apple's website that I'm looking at 61 00:02:26,610 --> 00:02:28,830 realizes that I'm on a desktop computer 62 00:02:28,830 --> 00:02:31,170 and so it's sending me the desktop version. 63 00:02:31,170 --> 00:02:34,170 Because the desktop computer has more processing, 64 00:02:34,170 --> 00:02:37,140 it can support an RSA encryption certificate. 65 00:02:37,140 --> 00:02:39,150 Now, the RSA encryption certificate 66 00:02:39,150 --> 00:02:43,140 is using a key size of 2,048 bits. 67 00:02:43,140 --> 00:02:46,710 Notice this is almost 10 times larger key size 68 00:02:46,710 --> 00:02:49,800 than the ECC certificate, but they provide 69 00:02:49,800 --> 00:02:53,010 equivalent capability as far as the security 70 00:02:53,010 --> 00:02:54,090 that they're going to give you. 71 00:02:54,090 --> 00:02:55,710 So that's really the difference between seeing 72 00:02:55,710 --> 00:02:58,140 this ECC public key certificate 73 00:02:58,140 --> 00:03:00,630 versus an RSA public key certificate. 74 00:03:00,630 --> 00:03:02,700 They're just a different type of encryption being used. 75 00:03:02,700 --> 00:03:05,100 ECC is favored when you're using mobile 76 00:03:05,100 --> 00:03:06,570 and low power devices. 77 00:03:06,570 --> 00:03:09,300 RSA is favored when you're using desktops. 78 00:03:09,300 --> 00:03:10,440 And so as you go through, 79 00:03:10,440 --> 00:03:12,780 you can figure out all the different pieces of information 80 00:03:12,780 --> 00:03:14,760 that make this digital certificate up, 81 00:03:14,760 --> 00:03:17,850 things like its key ID, things like its authentication 82 00:03:17,850 --> 00:03:20,670 and its identification, and then going all the way down, 83 00:03:20,670 --> 00:03:23,190 you can even get down to its unique fingerprint 84 00:03:23,190 --> 00:03:25,410 that identifies it as that certificate. 85 00:03:25,410 --> 00:03:26,760 And if I do the same thing on Google, 86 00:03:26,760 --> 00:03:28,710 you'll see it's a completely different one 87 00:03:28,710 --> 00:03:30,860 because they're two different certificates.