IBM WebSphere V5.0 Security - CGISecurity

identifies the client before issuing the certificate. The first step is to verifywhether or not the signature at the end of the request is valid (the public keyin the request can be used for validation). If no error is encountered, theneither the certificate can be issued or another client validation process can bestarted. The most secure method of client validation is for the client to appearpersonally and certify themselves at the authority location. If the clientcertification is successful, the certificate for the public key is created with thedesired key usage. The client can download the certificate into his/herbrowser registry or onto a smart card.2. The other way to issue certificates is to execute the key generation processon the server side. This means that private keys should be created on theserver side. This solution presents some problems:– The key generation requires a lot of computing power. There should bevery powerful computers applied as Certificate Authority (CA) machines orkey generation will be very slow (in case of multiple requests).– The private key must be issued and sent to the client, creating a weakpoint in the security.There are situations when this method is better for issuing certificates. Forexample, let us imagine a research institute with a few hundred employees.The institute wants to make the entrance of the building more secure and alsowants the computers to be used by the right persons. The company considersusing smart cards for solving both problems. A PKI system can beimplemented and every employee can get a smart card with a certificate anda private key. Obviously, the company will not establish a Web registrationmodule for the employees (because of the fixed and small number ofcertificates to issue), but it will create the keys and certificates, install them onthe cards and issue the cards to the customers. This process does not haveany weak points, because the cards will be given personally to each properperson. Smart cards usually do not allow the exporting of private keys, sothey cannot be corrupted (unless the card is stolen).InfrastructureA Public Key Infrastructure (PKI) system acts as a trusted third partyauthentication system. It issues digital certificates for the communication parties(for users and applications). Some of its tasks are:► Issuing of certificates► Revoking of certificates► Renewal of certificates► Suspension and resumption of certificates► Management of issued certificates16 IBM WebSphere V5.0 Security Handbook