PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Digital Certificates
355
end, the usual way of creating a digital signature is to create a message digest for the
whole message using a fast hash function and then encrypt only the brief digest using a
slow public key encryption algorithm.The signature can now be sent with the message
via any normal unsecure method.
When a signed message is received, it can be checked.The signature is decrypted
using the sender’s public key. A hash value is then generated for the message using the
same method that the sender used. If the decrypted hash value matches the hash value
you generated, the message is from the sender and has not been altered.
Digital Certificates
Being able to verify that a message has not been altered and that a series of messages all
come from a particular user or machine is good. For commercial interactions, being able
to tie that user or server to a real legal entity such as a person or company would be
even better.
A digital certificate combines a public key and an individual’s or organization’s details
in a signed digital format. Given a certificate, you have the other party’s public key, in
case you want to send an encrypted message, and you have that party’s details, which you
know have not been altered.
The problem here is that the information is only as trustworthy as the person who
signed it. Anybody can generate and sign a certificate claiming to be anybody he likes.
For commercial transactions, it would be useful to have a trusted third party verify the
identity of participants and the details recorded in their certificates.
These third parties are called certifying authorities (CAs).They issue digital certificates
to individuals and companies subject to identity checks.The two best known CAs are
VeriSign (http://www.verisign.com/)and Thawte (http://www.thawte.com/), but you
can use a number of other authorities.VeriSign owns Thawte, and there is little practical
difference between the two. Some other authorities, such as Network Solutions
(http://www.networksolutions.com) and GoDaddy (http://www.godaddy.com/), are
significantly cheaper.
The authorities sign a certificate to verify that they have seen proof of the person’s or
company’s identity. It is worth noting that the certificate is not a reference or statement
of creditworthiness.The certificate does not guarantee that you are dealing with somebody
reputable.What it does mean is that if you are ripped off, you have a relatively
good chance of having a real physical address and somebody to sue.
Certificates provide a network of trust. Assuming you choose to trust the CA, you can
then choose to trust the people they choose to trust and then trust the people the certified
party chooses to trust.
The most common use for digital certificates is to provide an air of respectability to
an e-commerce site.With a certificate issued by a well-known CA, web browsers can
make SSL connections to your site without bringing up warning dialogs.Web servers
that enable SSL connections are often called secure web servers.