CertiGuide to Security+  9  Chapter 4:  Basics of Cryptography (Domain 4.0; 15%)       9  4.3  PKI (Public Key Infrastructure)            9  4.3.1  Certificates

4.3.1  Certificates 1 4.3.1.1  Certificate Policies

A Certificate Authority is the digital world’s version of a notary public. A Certificate Authority (or CA) is a trusted third party (hopefully a responsible one) that verifies the legitimacy of the public/private key pair as really belonging to the individual in question. They use a variety of techniques, such as verifying one’s email address. You can request a digital certificate from a prominent CA such as VeriSign or Thawte, or (if you only need one for internal testing and don’t need strong validity for production use) generate one yourself using a variety of development tools.

A huge list of CA’s can be found at http://www.pki-page.org. Be aware that the cost for obtaining a digital certificate varies greatly on the source CA you choose, and the use to which you intend to put the certificate (certificates used by those who engage in high-value transactions normally undergo a more rigorous identity-verification process, and thus cost more).

Some public Certificate Authorities (CA’s) are specifically authorized or approved by governmental entities, such as the Utah and California state governments.

Not all Certificate Authorities are public. Some organizations may opt to create an internal Certificate Authority for purposes of issuing internal digital certificates to staff.

A Certificate Authority:

• Creates and distributes Public/Private keys.
  
  
• Publishes public keys in open directories.
  
  
• Secures private keys.
  
  
• Provides revocation in the event a private key is compromised.
  
  
• Verifies to users that a subscriber’s certificate is currently valid (has not expired or been revoked)
  
  
• Acts as a digital notary for the holders of public/private keys.
  
  
• Has a Registration Authority that is typically publicly available (subject to DoS attacks).

4.3.1  Certificates 1 4.3.1.1  Certificate Policies