Front cover - IBM Redbooks

236 Lotus Security Handbook
common access protocol, the Lightweight Directory Access Protocol (LDAP), of
which the latest version is LDAP v3.
LDAP is the most efficient and most widely accepted method for an End-Entity or
a CA to retrieve or modify the certificate and CRL information stored in a CR.
LDAP offers commands or procedures which do this efficiently and seamlessly,
such as: bind, search or modify, and unbind. As well, the attributes and object
classes to be supported by an LDAP server acting as server of a CR are defined,
and are called Schemas.
There are alternative methods for obtaining certificates or CRL information if a
CR is not implemented in a directory. However, these are not recommended and
after considering the requirements that a CR must meet, it turns out that a
Directory is actually the best place to store CR information. Such requirements
include: easy accessibility, standards-based access, up-to-date information
storage, built-in security (if required), data management issues and the possible
merging of similar data. In the case of a Domino-based Internet PKI, the CR is
the Domino Directory.
The Registration Authority (RA)
The Registration Authority (RA) is an optional component in a PKI. In some
cases, the CA incorporates the role of an RA. Where a separate RA is used, the
RA is a trusted End-Entity certified by the CA, acting as a subordinate server of
the CA. The CA can delegate some of its management functions to the RA. For
example, the RA may perform personal authentication tasks, report revoked
certificates, generate keys, or archive key pairs. The RA, however, does not
issue certificates or CRLs.
6.2.3 X.509 certificates
A crucial part of a PKI – and one worthy of its own section – is the X.509
certificate.
While there have been several proposed formats for public key certificates, most
commercial certificates available today are based on the international standard
ITU-T Recommendation X.509 (formerly CCITT X.509).
X.509 certificates are commonly used in secure Internet protocols, such as those
that we cover in the present chapter, namely:
► Secure Sockets Layer
► Secure Multipurpose Internet Message Extension (S/MIME)