How does SSL use symmetric and asymmetric encryption? And how do I manage certificated for multiple sites on one host? [duplicate]

Question

First, some quotation from Microsoft TechNet's Managing Microsoft Certificate Services and SSL:

To recap, secure SSL sessions are established using the following technique:

1. The user's Web browser contacts the server using a secure URL.

2. The IIS server sends the browser its public key and server certificate.

3. The client and server negotiate the level of encryption to use for the secure communications.

4. The client browser encrypts a session key with the server's public key and sends the encrypted data back to the server.

5. The IIS Server decrypts the message sent by the client using its private key, and the session is established.

6. Both the client and the server use the session key to encrypt and decrypt transmitted data.

So, basically speaking, the SSL use the asymmetric encryption (public/private key pair) to deliver the shared session key, and finally achieved a communication way with symmetric encryption.

Is this right?

Add - 1 - 5:55 PM 12/17/2010

I am using IIS to host my websites. Suppose I have multiple sites on my single machine, and I want the client brower to use SSL URL to connect my sites. How many certificates do I need? Which of the following approach should I take?

1 - Apply for a single certicate and associate it to my single server machine which hosts mutiple sites.

2 - Apply for several certificates and associate each of my sites with its own certificate.

In IIS7, it seems I could only do approach 1.

Update - 1 - 6:09 PM 12/17/2010

I figure it out. I could install mutiple certificates on my server machine and bind each site with seperate certificate as necessary.

Answer 1

Yes, that's right. Asymmetric encryption is necessary to verify the others identity and then symmetric encryption gets used because it's faster.