Problem - Kevin Tafuro

A digital certificate contains information about the person or organization to whom
it was issued (the subject) as well as information about the organization that issued
the certificate (the issuer). The issuer signs the certificate with its private key, and the
certificate may contain all of the information necessary to validate that signature,
including its public key. However, such information should not actually be used to
validate the signature on the certificate. After all, anyone could create a key pair to
use in signing, place it in the certificate, and claim it is from the issuer.
Certificates also have a serial number that is unique, at least across all certificates
from a given issuer. The serial number can be used to identify a certificate quickly.
The basic idea here is that the issuer signs the certificate with its private key, so anyone
who has securely obtained the issuer’s public key will be able to validate the
authenticity of the entire certificate. The entity to whom the certificate was issued
cannot change data in it, such as the expiration date. If she tries, the signature will
not check out.
Clearly, the issuer is vouching that the information in the certificate is correct when
it signs. If you trust the issuer’s validation of the core information, you should be
able to trust its signature.
Once a certificate has been issued, it is generally put into production. The entity with
the certificate gives it to parties that wish to communicate. Other people can validate
the certificate by checking the signature, assuming that they have securely
obtained the public key of the issuer. They can encrypt data to the public key found
in the certificate, and only the entity to which the certificate was issued should have
the corresponding private key needed to decrypt the data.
The issuer does not even have a copy of the private key. Generally, the subject generates
a key pair (a public key and an associated private key) and bundles the public
key along with a bunch of information into a certificate-signing request. The certification
authority (often called simply a CA) or its designate authenticates the data,
perhaps requiring interaction from the subject. Then, when it is confident enough,
the CA will create the final certificate, sign it, and give it back to the subject.
Certification authorities
A CA is an organization or company that issues certificates. A CA takes on the
responsibility of ensuring that the certificates it issues are legitimate. Nonetheless,
this does not mean that CAs are infallible. For example, there have been publicly
documented instances where VeriSign has issued certificates in Microsoft’s name to
someone not affiliated with Microsoft.
There are two basic types of CA:
Public CAs
An example is VeriSign. Anyone that a public CA is able to validate can get a certificate.
Understanding Public Key Infrastructure (PKI) | 505
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.