Front cover - IBM Redbooks

Figure 6-10 Cross-certification between two organizations
Cross-certification between two users
In this case, the cross-certification can be for two users, two servers, or a user
and a server.
Let’s assume a scenario in which the Acme and Widget organizations want to
replicate a database that contains information of common interest, but don’t want
to have anything but these two servers communicating with each another, as per
their security policy.
Here, the organizations want the most restrictive form of cross-certification, in
that they want a server in one organization to authenticate and replicate with a
server in the other organization. The following steps will accomplish this:
1. The Acme server (Server/Acme) obtains a cross-certificate for the Widget
server (Server/Widget) and stores it in the Acme server Personal Address
Book;
2. The Widget server (Server/Widget) obtains a cross-certificate for the Acme
server (Server/Acme) and stores it in the Widget server Personal Address
Book.
As a result of this procedure, a special relationship (that is, “the Acme server and
the Widget server trust each other”) is established. This is illustrated in
Figure 6-11 on page 214. In this cross-certification model, only these two servers
trust each another and can replicate with each other.
Chapter 6. Public key infrastructures 213