Filter
Top Products
Most importantly, a certicate binds the owner's public key to the owner's identity. Like a
passport binds a photograph to personal information about its holder, a certicate binds a
public key to information about its owner.
In addition to the public key, a certicate typically includes information such as:
■
The name of the holder and other identication, such as the URL of the Web server using
the certicate, or an individual's email address.
■
The name of the CA that issued the certicate.
■
An expiration date.
Digital Certicates are governed by the technical specications of the X.509 format. To verify
the identity of a user in the certificate realm, the authentication service veries an X.509
certicate, using the common name eld of the X.509 certicate as the principal name.
About Certicate Chains
Web browsers are precongured with a set of root CA certicates that the browser
automatically trusts. Any certicates from elsewhere must come with a certicate chain to verify
their validity. A certicate chain is series of certicates issued by successive CA certicates,
eventually ending in a root CA certicate.
When a certicate is rst generated, it is a self-signed certicate. A self-signed certicate is one
for which the issuer (signer) is the same as the subject (the entity whose public key is being
authenticated by the certicate). When the owner sends a certicate signing request (CSR) to a
CA, then imports the response, the self-signed certicate is replaced by a chain of certicates. At
the bottom of the chain is the certicate (reply) issued by the CA authenticating the subject's
public key. The next certicate in the chain is one that authenticates the CA's public key.
Usually, this is a self-signed certicate (that is, a certicate from the CA authenticating its own
public key) and the last certicate in the chain.
In other cases, the CA can return a chain of certicates. In this case, the bottom certicate in the
chain is the same (a certicate signed by the CA, authenticating the public key of the key entry),
but the second certicate in the chain is a certicate signed by a dierent CA, authenticating the
public key of the CA to which you sent the CSR. Then, the next certicate in the chain is a
certicate authenticating the second CA's key, and so on, until a self-signed root certicate is
reached. Each certicate in the chain (after the rst) thus authenticates the public key of the
signer of the previous certicate in the chain.
About Secure Sockets Layer
Secure Sockets Layer (SSL) is the most popular standard for securing Internet communications
and transactions. Web applications use HTTPS (HTTP over SSL), which uses digital certicates
to ensure secure, condential communications between server and clients. In an SSL
connection, both the client and the server encrypt data before sending it, then decrypt it upon
receipt.
Introductionto Certicatesand SSL
Chapter9 • ConguringSecurity 109