Re: IIS SSL Encryption handshake information

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 11/23/05 

Date: Tue, 22 Nov 2005 15:58:11 -0800

If you make the following request from the browser:

POST https://www.yourserver.com/redirected/default.jsp?sensitiveinfo=data

Then both the FORM entity body as well as sensitiveinfo=data will be
encrypted on the initial request. The server will need to complete the SSL
handshake to even retrieve any of that data from the request. This is how
SSL works. 

-- 
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"John McClain" <jm42163jm@yahoo.com> wrote in message
news:OJReb067FHA.3224@TK2MSFTNGP09.phx.gbl...
We have a servlet that is served by Tomcat. IIS is employed to redirect ot
Tomcat via AJP. IIS is also SSL enabled as our data is sensistive.
I am setting IIS to use SSL encryption on the default website. I have a
redirector that forwards request to Tomcat
I wish to call a jsp in Tomcat and pass SSL encrypted data. BUT, to start
the SSL handshake off, I am making a jsp request with the data I wish to be
SSL encrypted.
My question is
If I call a jsp from a browser and pass it some parameters that need to be
sent encrypted, do the parameters get SSL encrypted BEFORE they are sent, or
are they sent clear text, then the SSL Handshake, then all other data sent
is encrypted?

Relevant Pages

  • Re: SSL Overhead?
    ... Encryption itself isn't the sole culprit of data expansion. ... behind data expansion is the web service - and not SSL. ... I don't see how your comment on security has any credence. ...
    (microsoft.public.dotnet.framework.compactframework)
  • Re: SSL broken after Windows 2003 upgrade
    ... The svchost.exe you reference is "IIS". ... routes them to the appropriate w3wp.exe based on configuration from WAS ... WFetch can make both a normal SSL request as well as a Client-Certificate ...
    (microsoft.public.inetserver.iis)
  • Re: Secure web authentication system w/o SSL and PKI
    ... Authentication has nothing to do with SSL. ... Why do you want symmetric encryption? ...
    (comp.security.misc)
  • RE: ssh and ids
    ... box is the termination point of the SSL tunnel. ... Subject: ssh and ids ... Your claim is only partially true Peter. ... Encryption remains the bane of network-based intrusion ...
    (Focus-IDS)
  • Re: Why is .NET CF 2.0 (HttpWebRequest Class) using 40-bit Encryption over HTTPS?
    ... EndGetResponsemethod on the HttpWebRequest object. ... encryption, or requires no encryption at all, then my code works perfectly. ... I am investigating how to properly implement SSL Certificates because our ... above) and it still fails to communicate with the newly configured server. ...
    (microsoft.public.dotnet.framework.compactframework)