I'm not a networking guy, so I have little knowledge about internet protocols and SSL. My question is coming from a lack of understanding of how https operates.

Basically in https there is a phase where the Encryption algorithm and Private Key to decrypt any encrypted information that may be coming over the network is agreed upon the client and server, however this is all to create a safe and secure connection. But if the Private Key is send before there is a secure connection so what will prevent hackers intercepting this Private Key and thereby also intercepting any https requests that are encrypted but being that this hacker has the private key the data can easily be decrypted, so where is the security?

This always bothered me, thank you for all your answers!


2 Answers 2


The private key is never sent across the network, otherwise it would no longer be private. The private key of the server is used to authenticate the server, not to encrypt. For the actual encryption a session key is used, so the question remains how do client and server agree on a session key without making that known to an observer.

One way that combines authentication with key selection is that the clients chooses a random session key and encrypts it with the server's public key. If the server can decrypt it, it must have the corresponding private key, and therefor is the correct server, and know the session key the client selected. If it doesn't have the correct private key, it won't be able to decrypt the session key, and therefor not decrypt the data sent.

One flaw of this is that if the server private key gets known later, all previously recorded sessions can be decrypted. So a way to agree upon a session key that can not be discovered later is Diffie-Hellman key exchange. This is also called PFS.


We probably need someone to weigh in who knows SSL and TLS more intimately, but the whole idea of the private key is that it is never sent. Data encrypted with a private key can only be decrypted with the matching public key and vice-versa.

Looking at the protocol section of the TLS article on Wikipedia, the two ends carefully exchange just enough information during the protocol setup to lead to an encrypted connection. Basically, at no point is any encryption key sent in the clear.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .