Setting up a Connection

1. While a browser accesses an SSL-protected website, the browser automatically sends a request to the server, asking for the SSL Public Key. The browser processes this Public Key and sends a feedback to the server, which compares this result to an SSL Hidden Key on the server. As long as these values match, then the web browser enables the user to continue to access the website without warning. This connection process is called a "handshake" and occurs nearly instantly whenever a website is accessed. It is totally invisible to the user.

IP-Based Spoofing Protection

2. An SSL certificate is precise to the specific domain for which it was made, in spite of the IP address of that domain. So, if a malicious body were to try to redirect traffic for a particular website to their own malicious site from IP spoofing method, the fake site would not have an SSL certificate that was precisely registered to the actual website. This can be tested from a browser by viewing the certificate information, and if the wrong web address is displayed, then the user will know that they are not on the site they think they are on. This saves attackers from using IP spoofing to redirect users to a different site without their knowledge, even if that other site also has SSL activated.