The answer found on this server fault thread is my jumping off point for this general topic: https://serverfault.com/a/313558

... and this question can be thought of as a follow-up to that answer.

Does my SSL cert have anything to do with or say about the symmetric session key? (I know that the browser and web server both have a role there, but what about the cert itself?)

If YES: Where is it specified in the cert?

If NO: Why do CAs all boast about "128-bit to 256-bit encryption" which is implicitly referring to the session key?

  • 3
    The answers are NO, and because all marketing people should be shot, respectively. – Michael Hampton Jun 8 '15 at 20:44
  • Maybe the marketing guys talk about the symmetric session key while submitting the CSR, from the client's browser to their own servers... – sebix Jun 9 '15 at 7:26

No. The strength and type of the symmetric encryption used is negotiated by your browser and webserver (and thus based on their configuration). The certificate simply allows the key agreement to happen in a secure (authenticated) fashion.

Concerning your follow-up question: It's mostly a marketing gag. The certificate they sell enables you to use 256-bit encryption during the session. Which is, of course, also true for absolutely any standard compliant X.509 certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.