-: In this demonstration we're going to explore
the digital certificates associated with a few websites
and the type of information they contain
in their public key certificates.
On the screen you see two websites.
I have Google on the left and Apple on the right.
Both of these are being visited
over an HTTPS connection over port 443.
If I click the little lock next to the website name,
you're going to see that it does have a digital certificate
and it's valid.
Now, in Chrome, if I click on that
it will give me the details of that certificate.
Notice that the website certificate is for www.google.com.
That's its public key certificate.
It was issued by the Google Internet Authority G3,
and it was globally signed.
Now, if I look at the details of this
I can see who the subject is.
Who is the person this was issued to?
This digital certificate was issued to Google LLC
out of Mountain View, California.
It was issued by Google Trust Services,
which is one of the big
online digital certificate providers.
You can see that it uses SHA-256 to provide integrity
of that signature and the encryption is using RSA.
Now, as you go further, you can see when it's valid for.
You can see the public key info.
This is being sent as an ECC public key certificate,
and it has a key size of 256 bits.
I'm going to stop on that site and go look at Apple now.
So when I go over here to Apple,
you can see that this certificate was issued to Apple Inc.
out of Cupertino, California.
That's where Apple's headquarters is.
If you scroll down, you'll see who issued it.
It wasn't issued by Apple themself,
it was issued by DigiCert,
another large digital certificate
high assurance root certificate authority.
Now, you can also see when it was valid before and valid to,
and as you scroll down a little bit further,
you'll get the information on its public key information.
On the left with Google we're using ECC,
Elliptic Curve Cryptography.
On the right we're using RSA encryption.
Now, why is there a difference there?
Well, Google has a very minimalist site,
and they also are focused very heavily on mobile browsers.
Mobile devices have less processing power
than a desktop would.
And so if you're visiting a website
and you're using a mobile browser,
they try to send you an ecliptic curve certificate instead
because with a smaller key size, using only 256 bits,
we still get a high level of security.
On the right, Apple's website that I'm looking at,
realizes that I'm on a desktop computer
and so it's sending me the desktop version.
Because the desktop computer has more processing,
it can support an RSA encryption certificate.
Now, the RSA encryption certificate
is using a key size of 2,048 bits.
Notice this is almost 10 times larger, key size,
than the ECC certificate,
but they provide equivalent capability
as far as the security that they're going to give you.
That's really the difference between
seeing this ECC public key certificate
versus an RSA public key certificate.
They're just a different type of encryption being used.
ECC is favored when you're using mobile
and low-power devices.
RSA is favored when you're using desktops.
And so as you go through,
you can figure out all the different pieces of information
that make this digital certificate up.
Things like its key ID,
things like its authentication and its identification,
and in going all the way down
you can even get down to its unique fingerprint
that identifies it as that certificate.
If I do the same thing on Google,
you'll see it's a completely different one
because they're two different certificates.
(digital buzzing music)