IBM WebSphere V5.0 Security - CGISecurity

►►Issuing a list of revoked certificatesProtection of the private keyFigure 2-6 shows three different certification scenarios in one picture.Root BCertificateAuthortycrosscertificationRoot ACertificateAuthortyOrganization CCertificateAuthortyOrganization ACertificateAuthortyOrganization BCertificateAuthortySecured communicationUser DUser AUser BUser CFigure 2-6 Simple certification scenariosThe certification scenarios depicted above are as follows:► When User A wants to talk to User B, both of their certificates are issued andsigned by the same Certificate Authority (Organization A); they can trust eachother, and the secure communication will build up based on the trust.► When User A or User B wants to talk to User C, their certificates are comingfrom the same Root Certificate Authority (Root A); they can trust each otheragain. This scenario shows the hierarchy of the certificates, where thecertificate has been signed by a chain of CAs. As long as the two parties havemutual Certificate Authorities along the line, they can trust each other.► When User D wants to talk to User A or User B or User C, their certificationpaths are different. To resolve the problem, the two root Certificate Authorities(Root A, Root B) can set up a trust between each other by setting up a crosscertification. Once the two parties have cross certified CAs along the path,they can trust each other.Chapter 2. Security fundamentals 17