IBM WebSphere V5.0 Security - CGISecurity

►
►
Issuing a list of revoked certificates
Protection of the private key
Figure 2-6 shows three different certification scenarios in one picture.
Root B
Certificate
Authorty
cross
certification
Root A
Certificate
Authorty
Organization C
Certificate
Authorty
Organization A
Certificate
Authorty
Organization B
Certificate
Authorty
Secured communication
User D
User A
User B
User C
Figure 2-6 Simple certification scenarios
The certification scenarios depicted above are as follows:
► When User A wants to talk to User B, both of their certificates are issued and
signed by the same Certificate Authority (Organization A); they can trust each
other, and the secure communication will build up based on the trust.
► When User A or User B wants to talk to User C, their certificates are coming
from the same Root Certificate Authority (Root A); they can trust each other
again. This scenario shows the hierarchy of the certificates, where the
certificate has been signed by a chain of CAs. As long as the two parties have
mutual Certificate Authorities along the line, they can trust each other.
► When User D wants to talk to User A or User B or User C, their certification
paths are different. To resolve the problem, the two root Certificate Authorities
(Root A, Root B) can set up a trust between each other by setting up a cross
certification. Once the two parties have cross certified CAs along the path,
they can trust each other.
Chapter 2. Security fundamentals 17