-: Digital Certificates.
A certificate is a digitally-signed
electronic document that binds a public key
with a user's identity.
Now, when I talk about a user here,
the user can be a real live person like you and I
or it can be a server,
a work station or another device
for the purposes of a digital certificate.
These certificates commonly use
the X.509 standard for digital certificates.
This is the common standard used inside of PKI
and the certificates contain the owner's
or user's information like their name,
their organization or even their public key
and it also is going to contain
the certificate authority's information.
The certificate authority is the trusted third party
who is going to issue these digital certificates,
and therefore the certificate's also going to contain
their name, their digital signature,
their serial number for that certificate,
the issue date and the expiration dates
and the version of the certificate.
In the next video we're actually going to explore
the digital certificates for Google
and Apple's web servers and you're going to see
exactly the kind of information that's contained
in an X.509 digital certificate.
To get a digital certificate for your web server
you have to purchase that certificate
from a certificate authority
or a registration authority.
Normally when a certificate is purchased
for a server it's only applied
to one server by default.
So if you're going to purchase a certificate
for diontraining.com it would not be able
to be used for both www.diontraining.com
and courses.diontraining.com.
But if I use a wildcard Certificate
I can use it for both.
A wildcard certificate is going to allow all
of the subdomains to use the same
public key certificate and have it displayed as valid.
Wildcard certificates are easier to manage,
especially if all of your servers will be subdomains
off your main web domain.
And so this will allow you to use one certificate,
save a little bit of money
and make your life a little bit easier.
In fact, all of my websites,
we use wildcard certificates
because of the ease of maintainability.
But with every advantage
there are some disadvantages
that you have to consider
if you're going to use wildcard certificates.
The biggest one is that
if your server is compromised
and that certificate needs to be revoked
it's going to affect all
of your other subdomain servers.
Luckily, reissuing a new certificate's fairly quick
and since you only
have a single wildcard certificate to use,
you're going to be able to get that back online fairly quickly.
But this is something you need to be aware of
when you're deciding whether
or not you should choose single use certificates
or a wildcard certificate?
Some organizations have multiple websites
with different domain names as well.
For example, I own diontraining.com
but I also own jasondion.com.
Now, if I wanted to use one certificate
to cover both of those domains
because they don't have the same root domain,
I would have to modify the Subject Alternate Name
or the SAN field.
Now, the SAN field in a certificate specifies
what additional domains and IP addresses
are going to be supported by that certificate.
Two other types of certificates
that we have to think about are single-sided
and dual-sided certificates.
Now for example,
when you connect on my website
there's a secure session that's established
and my server's going to identify itself
to your web browser
using my server's digital certificate.
Now, you aren't required to have your own
digital certificate to be authenticated
back to me though.
This is known as a single-sided certificate
because only one side of this authentication
is happening with the certificate.
Now, some organizations require
both the server and the user
to validate each other using certificates.
When this occurs this is called
a dual-sided certificate.
Now, using dual-sided certificates,
it's better for security but it does require
twice the processing power on the server,
so it's usually only used
in high security environments.
Now, with digital certificates each certificate
is validated using the concept of a chain of trust,
moving from the bottom upward.
Now, I like to think of this like a family tree.
Let's assume your grandfather's the patriarch
of your family and everyone trusts him.
He then had your father
and so since our grandfather trusts our father,
we also are going to trust our father.
Then our father had us.
And no one is really sure if they should trust us
or not, right?
But if they trusted our father
and our father is trusted
because of our grandfather,
it can go up that chain
and we can be trusted as well.
That's the same idea here.
Your grandfather is the root certificate authority
because he is the highest level
in this particular little family tree.
The family tree is known as a certification path.
Now, if I had a child,
that child would then have to go back
up our family tree again and have our grandfather
vouch for Junior's trustworthiness
and so on down our family tree.
As I said before,
digital certificates are usually based
on the X.509 standard but the certificate itself
must be encoded before it can be used.
Now, there are three different encoding methods
that are classified under the X.690 standard.
They're known as BER, CER and DER.
BER is the Basic Encoding Rules
and it's the original ruleset governing
the encoding of data structures for certificates.
But there are several different encoding types
that can be used as part of BER.
Now, for the Security+ exam you don't need
to know the specific encoding types underneath BER.
So we're not even going to cover them here
but just realize that BER has the ability
to have multiple encoding types.
And that makes it different than CER.
CER is the Canonical Encoding Rules
which is a restricted version of BER
that only allows the use of one encoding type.
DER is the Distinguished Encoding Rules.
And this is another restricted version of BER,
and it only allows one encoding type as well
but it has more restrictive rules for length,
character strings and how a particular element
of a digital certificate is stored.
In fact, DER is what is used commonly
for X.509 encoding of certificates.
When dealing with digital certificates
you may come across a few different file types
on your machine,
including the PEM,
CER,
CRT,
KEY,
P12,
PFX
and P7B.
The .pem format is used
for Privacy-enhanced Electronic Mail
and it uses the DER encoding method.
Sometimes it also stores itself as a .cer,
.crt or .key file.
The .p12 file is going to be used
to store a server certificate,
an intermediate certificate and a private key
in one encrypted file.
It's called the .p12 because it's a binary format
of the Public Key Cryptographic System #12
or PKCS#12 certificate.
Now, the .pfx file is called
the Personal Information Exchange
and it's used by Microsoft for release signing.
This file is going to contain both the private
and public keys in it.
The .p7b file is used as the basis for S/MIME,
the secure email protocol.
And this is also going to be used for single sign-on.
It's called the .p7b because it's based
on the PKCS#7.
Now, I know that was a lot of information.
For the exam I doubt you're going to get a question
on any of the details of these particular file types
but if you see a file type listed
on the exam like .p12 you should remember
that it has to do with PKI in general.
And then you'll be able to choose an answer
that's appropriate based on that.