Problem - Kevin Tafuro

Private CAs
Usually, private CAs are internal to a corporation or other organization, and they
issue certificates internally. It is expected that people outside the organization
won’t be using the CA and therefore won’t trust the certificates it issues.
Public CAs commonly issue certificates for public web sites requiring encryption and
authentication, often for e-commerce. For such operations, it is important that the
customer transmits her information to the site that is supposed to be receiving it,
without worrying that someone else is obtaining the information. This is why server
certificates generally store the domain name of the server: if you think you’re buying
a book from Amazon.com, it’s important to see a certificate presented that includes
Amazon’s domain name. If you check only the CA’s signature and don’t check that
the domain name is correct, you have no way to tell that you are using the right public
key. Instead, you could have checked the signature on a valid certificate issued to
Fred from Fred’s Mattress Warehouse.
For a private CA, verifying the identity of a subject is often simple because the identity
of employees can generally be established quite easily. The human resources
department at a company generally has proof of identity and right to work for each
of its employees.
In such a scenario, the human resources department is said to be acting as a registration
authority (RA), which is the organization that actually does background validation.
Sometimes, this is the same organization as the CA, and sometimes the CA will
farm out the work to other people. For example, VeriSign uses a set of companies as
RAs.
For a public CA (or its designated RA), verifying the identity of a subject is considerably
more difficult than it is for a private CA. The information required from the subject
to prove its identity to the CA depends on the type of certificate being issued,
and on whether the subject is an individual or a business. For example, if you get an
email digital certificate, a CA may only care that you can respond to email at the
given address. On the other hand, for a server-side certificate, individuals should
need to provide proof of identity, and businesses should need to provide various
pieces of corporate paperwork.
Because most CAs are out to make money first and serve the public second, checks
on identities are often not as thorough as they could be. In addition, CAs do not
assume any liability for when they are wrong; in other words, they provide no concrete
guarantees.
Running a private CA is quite appealing for applications that expect to see limited
deployment that is explicitly controlled by the software vendor. OpenSSLcan be
used to run a CA, but doing so is outside the scope of this book (it’s really a system
administration task, not a programming task). Note, however, that the topic of running
a small CA is covered in the book Network Security with OpenSSL (O’Reilly &
Associates).
506 | Chapter 10: Public Key Infrastructure
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.