-: For a digital certificate to be issued,
a user first has to request a digital certificate
from a Registration Authority known as an RA.
The Registration Authority
then requests the identifying information from the user
and forwards that certificate request up to the CA
known as the Certificate Authority.
This Certificate Authority
then creates the digital certificate,
including the user's public key
and their identity information,
and passes that back to the user.
There are many root certificate authorities out there
including companies like Verisign, Digisign,
and numerous others.
They act as a trusted third party to validate
the certificates are being issued to the correct people.
The certificate authority also maintains
a publicly accessible copy of that user's public key
and this allows them to have that for use by other users
who wish to send them confidential information.
So when you want to go to my web server,
you can go to that trusted third party
and pull my public key, encrypt something,
and then send it to me.
Now they also maintain what's known as a CRL
which is a Certificate Revocation List.
The Certificate Revocation List
is an online list of digital certificates
that the certificate authority has already revoked.
Usually, this is because those certificates
have become comprised.
The Certificate Revocation List
is a full list of every certificate
that has ever, ever been revoked
by that particular certificate authority.
Whenever your computer tries to connect to a new server,
it requests the current public key digital certificate
from the certificate authority.
The certificate authority first checks
the Certificate Revocation List
before they send you that public key or digital certificate
to ensure it hasn't already been revoked.
Now if you want to determine if a certificate was revoked,
we're going to use a protocol known as the OCSP
or Online Certificate Status Protocol.
This protocol is going to allow you to determine
the revocation status of any digital certificate
using its serial number.
This is an alternative to the Certificate Revocation List
and operates much more quickly and much more efficiently
because it doesn't use encryption,
but that makes it less secure.
Just as OCSP was an alternative
to Certificate Revocation List,
OCSP Stapling is an alternative to OCSP.
This process used to be known
as the TLS Certificate Status Request Extension.
This OCSP Stapling allows the certificate holder
to get the OCSP record from the server at a regular interval
and include it as part of the SSL or TLS handshake.
By doing so,
it eliminates an additional connection being required
at the time of the user's request
and this speeds up the secure tunnel creation process.
Now one concern with digital certificates
is if an attacker can impersonate a server.
To prevent this from occurring,
public key pinning was created.
Public key pinning allows an HTTPS website
to resist impersonation attacks
from those who are trying to present fraudulent certificates
by presenting a set of trusted public keys
to the user's web browser as part of its HTTP header.
Now if the web browser doesn't get the matching public key
from the certificate authority,
then it knows that website was compromised
and it's going to alert the user.
The last two concepts we need to mention
in regards to certificate authorities
are key escrow and key recovery agents.
Key escrow occurs when a secure copy
of a user's private key is held
just in case that user accidentally loses their key.
If your organization simply can't accept any data loss,
then you need to ensure key escrow has been setup.
Now remember whenever you use key escrow,
you have to protect that key store
from anybody who's trying to steal those keys.
It's recommended that key escrow services
require two different administrators be present
anytime a key is being taken out of escrow.
This is going to help you implement
the concept of a separation of duties.
Now the second concept is a key recovery agent.
A key recovery agent is a specialized type of software
that allows the restoration of a lost
or corrupted key to be performed.
Think of it as a backup
for all of the certificate authority's keys
just in case an incident or disaster occurred.
Finally, I want you to remember this.
If a root CA is compromised by an attacker,
then every certificate that has been issued by that CA
is now considered compromised
and they have to be revoked and reissued.
Luckily, this isn't a frequent occurrence
especially with commercial certificate authorities.
But if you're running your own certificate authority
within your organization and this gets compromised,
this is something you need to be aware of
so you can revoke all of your digital certificates
and then create new secure ones.