Understing How HTTPS works and queries on this?
I have gone thru two good links  about HTTP Vs HTTPS i.e 
http://en.wikipedia.org/wiki/HTTP_Secure
http://answers.yahoo.com/question/index?qid=20070604161212AAsnSFX

i have come up with my simple understanding and some queries.Here is the understanding :-

1)As we move to https from http we  have to modify  the webapplication so that as it receives the first request, it sends the digital certificate with the response. 

2)The other  thing  we have to modify is server.xml to include keystore location(like value is .keystore) and password. This keystore will actually contain the key that will be used to encrypt and
decrypt the data on both the sides i.e server and client(browser).

3)Now when client sends the first request it gets the encryped data, certificate and key. On the basis of this key , browser decrypt the data and encrypt
again to send it back to client. Once browser accepts checks the authenticity of certificate, it gives clearance saying it is trusted site.

Are the steps above correct?
If yes, how come we can say hackers can beak this. Because if encryption and decryption is happening  on the basis algorithm(based on key liying in .keystore file),
they can also decrypt the data when the request is being sent to server. If browser can that algorith why not hackers? I agree it will add one extra security
step but still it can be hacked. Just a thought?

Understing How HTTPS works and queries on this?
===

I have gone thru two good links  about HTTP Vs HTTPS i.e 
http://en.wikipedia.org/wiki/HTTP_Secure
http://answers.yahoo.com/question/index?qid=20070604161212AAsnSFX

i have come up with my simple understanding and some queries.Here is the understanding :-

1)As we move to https from http we  have to modify  the webapplication so that as it receives the first request, it sends the digital certificate with the response. 

2)The other  thing  we have to modify is server.xml to include keystore location(like value is .keystore) and password. This keystore will actually contain the key that will be used to encrypt and
decrypt the data on both the sides i.e server and client(browser).

3)Now when client sends the first request it gets the encryped data, certificate and key. On the basis of this key , browser decrypt the data and encrypt
again to send it back to client. Once browser accepts checks the authenticity of certificate, it gives clearance saying it is trusted site.

Are the steps above correct?
If yes, how come we can say hackers can beak this. Because if encryption and decryption is happening  on the basis algorithm(based on key liying in .keystore file),
they can also decrypt the data when the request is being sent to server. If browser can that algorith why not hackers? I agree it will add one extra security
step but still it can be hacked. Just a thought?
