Scribd Logo
Upload

Welcome to Scribd!

  • 50 views

    Chapter 5

    Uploaded by

    Joshua Carelo
    This document discusses managing digital certificates and public key infrastructure (PKI). It covers installing a certificate authority hierarchy, enrolling certificates, securing network traffic with certificates, renewing and revoking certificates, and backing up private keys. Certificates are used to prove identity and authorize users. A certificate authority issues, distributes, and manages certificates. PKI establishes policies and procedures for managing digital certificates, certificate authorities, registration authorities, and certificate signing requests throughout the certificate lifecycle.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Chapter 5

    Uploaded by

    Joshua Carelo
    50 views13 pages
    This document discusses managing digital certificates and public key infrastructure (PKI). It covers installing a certificate authority hierarchy, enrolling certificates, securing network traffic with certificates, renewing and revoking certificates, and backing up private keys. Certificates are used to prove identity and authorize users. A certificate authority issues, distributes, and manages certificates. PKI establishes policies and procedures for managing digital certificates, certificate authorities, registration authorities, and certificate signing requests throughout the certificate lifecycle.

    Original Title

    Chapter 5 (1)

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses managing digital certificates and public key infrastructure (PKI). It covers installing a certificate authority hierarchy, enrolling certificates, securing network traffic with certificates, renewing and revoking certificates, and backing up private keys. Certificates are used to prove identity and authorize users. A certificate authority issues, distributes, and manages certificates. PKI establishes policies and procedures for managing digital certificates, certificate authorities, registration authorities, and certificate signing requests throughout the certificate lifecycle.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    50 views13 pages

    Chapter 5

    Uploaded by

    Joshua Carelo
    This document discusses managing digital certificates and public key infrastructure (PKI). It covers installing a certificate authority hierarchy, enrolling certificates, securing network traffic with certificates, renewing and revoking certificates, and backing up private keys. Certificates are used to prove identity and authorize users. A certificate authority issues, distributes, and manages certificates. PKI establishes policies and procedures for managing digital certificates, certificate authorities, registration authorities, and certificate signing requests throughout the certificate lifecycle.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 13

    Managing Certificates

     Install a CA Hierarchy
     Enroll Certificates
     Secure Network Traffic by Using Certificates
     Renew Certificates
     Back Up and Restore Certificates and Private Keys
     Revoke Certificates

    Certificates - provide the primary method of identifying that a given user is valid. Certificates can also be used
    to store authorization information. Another important factor is verifying or certifying that a system is using the
    correct software and processes to communicate.

    Certificate Authority (CA) - responsible for maintaining certificates in the PKI environment
    - an organization that is responsible for issuing, revoking, and distributing certificates
    Digital Certificates
     an electronic document used to prove the ownership of a public key

    Certificate Authentication
    Public Key Infrastructure (PKI)
     a set of roles, policies, and procedures needed to create, manage, distribute, use, store & revoke digital
    certificates and manage public-key encryption.
    PKI Components
     Digital certificates
     Certificate authorities
     Registration authority
     Certificate repository database
     Certificate management system
     Certificate signing request

    CA Hierarchies
    The Root CA

    Public and Private Roots


    Subordinate CAs

    Offline Root CAs


     The root CA remains offline.
     Subordinate CAs will issue certificates.
     All updates are made only to subordinate CAs.
    CA Hierarchy Design Options

    The Certificate Enrollment Process


    The Certificate Life Cycle

    Certificate Life Cycle Management


     Longer life cycles give attackers an advantage.
     Shorter life cycles allow for renewal of more secure certificates.
    SSL Enrollment Process

    Certificate Renewal
     Certificates expire and need to be renewed.
     Renewal process upholds security and accessibility.
    Private Key Protection Methods
     Back up to removable media
     Delete from insecure media
     Require restoration password
     Never share
     Never transmit on network
     Use key escrow

    Key Escrow
     Alternative to key backup.
     Allows one or more trusted third parties access to the keys under predefined conditions.
     Third party is called the key escrow agent.

    Key escrow - an arrangement in which the keys needed to decrypt encrypted data are held in escrow so that,
    under certain circumstances, an authorized third party may gain access to those keys. These third parties may
    include businesses, who may want access to employees' private communications, or governments, who may wish
    to be able to view the contents of encrypted communications.
    Private Key Restoration Methods
    Key escrow:
     One or more escrow agents can restore
    Key backup:
     Restore from backup media

    The Private Key Replacement Process


    1. Recover key
    2. Decrypt data
    3. Destroy original key
    4. Obtain new key pair
    5. Encrypt data with new key
    Certificate Revocation
     Private key compromised
     Fraudulent certificate
     Holder no longer trusted

    Certificate Revocation List (CRL) - created and distributed to all CAs to revoke a certificate or key
    Online Certificate Status Protocol (OCSP)
     Alternative to CRL
     HTTP-based
     Checks specific certificate based on request
     Sends response with certificate’s status
     Lower overhead than CRL
     Lacks encryption
     the mechanism used to verify immediately whether a certificate is valid. The Certificate Revocation List
    (CRL) is published on a regular basis, but it isn’t current once it’s published.

    You might also like