Problem - Kevin Tafuro

had three different valid root certificates for their “class 3” PKI, which was generally for
server certificates. One of those has now expired, and another one will expire in 2004.
Here we detail only a subset of certificates that are distributed with Internet Explorer
for Windows. Certificates in this list may expire, in which case you should go
directly to the CA or to some other trusted source. At the time of writing, any valid
certificate signed by one of the CAs listed in Table 10-1 is likely to be signed by one
of the associated certificates.
Usually, you should not simply trust all root certificates. For example,
email certificates (class 1) do not really offer a guarantee about who is
on the other end. In addition, you will want to validate other information
about certificates, even if the CA’s signature is valid (see Recipes
10.4 through 10.7).
The “use” column in the table indicates the kind of certificate the root CA certificate
uses to sign. Generally, certificates are intended for one of the following purposes:
Secure email
The CA is rarely validating anything other than the fact that the person with the
private key associated with the certificate has access to the email address listed in
the certificate. Such certificates are used in the S/MIME secure email standard.
Client authentication
The CA (or its subordinate) has done reasonable validation on the identity of the
entity to which the certificate is issued.
Server authentication
Used primarily for electronic commerce over the Web. The CA or its subordinate
has done validation on the identity of the entity to which the certificate is
issued.
Code signing
Used for validating the vendor that produced mobile code. The CA or its subordinate
has done validation on the identity of the entity to which the certificate is
issued.
Time stamping
Used for proving the existence of data at a specific date and time.
Table 10-1. CA certificates, their uses, expiration dates, and fingerprints
CA Certificate Use
Equifax Secure Certificate
Authority
520 | Chapter 10: Public Key Infrastructure
Secure email, server authentication,
code signing
Equifax Secure eBusiness CA-1 Secure email, server authentication,
code signing
Expires
(GMT) MD5 fingerprint
2018-08-22
16:41:51
2020-06-21
04:00:00
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
67:CB:9D:C0:13:24:8A:82:9B:
B2:17:1E:D1:1B:EC:D4
64:9C:EF:2E:44:FC:C6:8F:52:
07:D0:51:73:8F:CB:3D