Encryption is a mathematical process of coding and decoding information. The number of bits (40-bit, 56-bit, 128-bit, 256-bit) tells you the size of the key. Like a longer password, a larger key has more possible combinations. In fact, 128-bit encryption is one trillion times one trillion times stronger than 40-bit encryption.

When an encrypted session is established, the strength is determined by the capability of the web browser, SSL certificate, web server, and client computer operating system. Most SSL certificates are capable of strong encryption (128-bit or higher). However, without SGC technology, certain older browsers and operating systems cannot step-up to 128-bit encryption. SGC SuperCerts enable 128- or 256-bit encryption for over 99.9% of Internet users. Thawte® SGC SuperCerts with SGC enable every site visitor to experience the strongest encryption available to them.

Users with the following browser versions and operating systems will temporarily step-up to 128-bit SSL encryption if they visit a web site with an SGC-enabled SSL certificate:

• Internet Explorer export browser versions from 3.02 but before version 5.5
• Netscape export browser versions after 4.02 and up through 4.72
• Windows 2000 systems shipped prior to March 2001 that have not downloaded Microsoft’s High Encryption Pack or Service Pack 2 and that use Internet Explorer

(Internet Explorer browser versions prior to 3.02 and Netscape browser versions prior to 4.02 are not capable of 128-bit encryption with any SSL certificate.)

When a secure session is established, the browser checks that the SSL certificate is trusted and valid.

1. The SSL certificate is trusted if it is signed by a "trusted" or pre-installed root certificate. As an established, globally recognized certificate authority, Thawte root certificates have been pre-installed in most major browsers since 1996.
2. The SSL certificate is valid if it has not expired or been revoked. Certificate authorities manage a Certificate Revocation List (CRL) used by browsers to check validity. Newer browsers have adopted Online Certificate Status Protocol (OCSP), a faster, more efficient way to verify certificate status. Thawte has a global infrastructure that handles 6 billion OCSP look ups every day.
3. The domain name in the certificate matches the domain name of the site being accessed. Thawte verifies the domain name as well as the applicant or organization’s control of the domain name before issuing the certificate.

If any of the checks fail, an alert is generated in real-time to the user who decides whether to proceed, cancel the session or view the SSL certificate. To prevent security alerts that erode trust, choose an SSL certificate from an established certificate authority with OCSP.