I'm a .net developer and I'm currently working on moving the asp.net project from http to https.
I have worked my way through few tutorials and I'm wondering whether I have missed anything out.
So far:
I have installed and configured CA on the server. CA service is running fine but I'm not entirely sure whether it needs to be accessible from outside? I have a localhost/certsrv running to submit the certificate requests. Later I log onto the server and confirm/deny the requests.
On the same server I have configured an IIS. Confirmed the certificate that was generated by the CA service. Enabled anonymous authentication and set the password to be send in the clear text.
I'm not 100% on how the certificate works. Do I understand this correctly?
- I log onto the website: https\someaddress.domain\site
- There is a certificate that's associated with this website so the window comes up stating that this is an unknown certificate.
- I confirm that I want to view the website and the browsers takes me onto that website.
How does this improve the security when I transfer data between browser and the web server?