Certificates - CompTIA Security+ SY0-701 - 1.4

Understanding Digital Certificates

What is a Digital Certificate?

• A digital certificate is a file containing a public key and a digital signature, functioning similarly to an identification card but with broader capabilities in IT security.

• Trust is a fundamental characteristic sought in IT security, as it ensures that the person accessing a system is indeed who they claim to be.

Establishing Trust with Digital Certificates

• Digital certificates can establish trust through centralized certificate authorities (CAs) that digitally sign certificates, ensuring mutual trust between users and systems.

• An alternative method for establishing trust is the "web of trust," where individuals sign each other's certificates, allowing for decentralized validation of identity.

The Role of Certificate Authorities

• Browsers display secure connections via a lock icon; clicking this reveals details about the web server's certificate, which adheres to the X.509 standard format recognized universally.

• Digital certificates contain extensive information including serial numbers, versioning, signature algorithms, issuer details, holder names, and public keys. This data aids in securing networks effectively.

Building Trust in Unknown Entities

• The challenge lies in trusting unknown entities when first connecting to websites; third-party verification from trusted sources helps establish this necessary trust relationship.

• The concept of "root of trust" refers to components (hardware or software) that provide foundational assurance regarding system integrity and authenticity.

Browser Trust Mechanisms

• Browsers utilize built-in methods to determine if websites are trustworthy by relying on trusted third parties known as certificate authorities (CAs). These CAs digitally sign website certificates for validation purposes.

• When visiting new websites, users can verify their legitimacy by checking if their certificates are signed by recognized CAs already trusted by their browsers. This process occurs seamlessly during daily internet use.

Purchasing Certificates from CAs

How to Create and Manage Digital Certificates

The Process of Creating a Digital Certificate

• The initial step involves creating a digital certificate using a public key, identifying server information, and organizational details to form a Certificate Signing Request (CSR), which is sent to a certificate authority.

• The certificate authority (CA) validates the CSR by confirming ownership of the web server. If validated, they digitally sign the certificate with their private key and return it.

• Validation is crucial; without it, trust in certificates from that CA cannot be established. This process underpins the trust associated with digital certificates.

Internal Certificate Authority Setup

• Organizations can establish their own internal CA for applications only accessed internally. This requires installing CA software within the organization.

• By distributing the public certificate of the internal CA across all organizational computers, employees' machines will trust this internal CA similarly to external CAs.

• Many software options exist for creating an internal CA, such as Microsoft Windows Certificate Services and OpenCA. This allows organizations to generate their own certificates without relying on external CAs.

Trust Mechanism and Subject Alternative Names

• The process for creating and signing certificates remains consistent whether using an internal or external CA; trust is maintained through proper installation of the internal CA's certificate on devices.

• When visiting websites, users can view detailed information about certificates by clicking on the lock icon in browsers.

• Wildcard certificates allow multiple subdomains under one domain name (e.g., *.birdfeeder.live), simplifying administration by enabling one certificate for various services linked to that domain.

Revocation of Certificates

• In cases where servers are decommissioned or if there's suspicion of compromised security, revoking certificates becomes necessary. A Certificate Revocation List (CRL) tracks revoked certs managed by the CA.

• Administrative processes for creating and revoking certificates are standard features in any CA system.

• An example highlighting revocation importance occurred during the Heartbleed vulnerability incident in April 2014 when many certificates had to be revoked due to security risks associated with OpenSSL vulnerabilities.

Accessing Revocation Information

• Users can find CRL Distribution Points within their browser's certificate details, providing links to CRL files that list revoked certificates.

• Understanding how revocation works is essential for maintaining trust in digital communications; users should know how to access this information via their browser settings.

Understanding Certificate Revocation and OCSP

The Role of Certificate Revocation Lists (CRLs)

• A third-party website provides a certificate to your browser, which then checks the certificate for CRL distribution points to download the revocation list.

• If the certificate is not listed as revoked, browsing continues; if it is revoked, access to the site is denied due to trust issues with that certificate.

Limitations of CRLs

• Maintaining a single file for all revocations from a certificate authority (CA) can be inefficient, especially when accessing large lists.

• To improve efficiency, protocols like OCSP (Online Certificate Status Protocol) have been developed to streamline the process of checking certificate validity.

Introduction to OCSP and Its Benefits

• OCSP allows web servers to send status messages about their certificates during the SSL handshake, enhancing efficiency by embedding this information directly.

• Most modern browsers support OCSP, enabling them to handle revocation checks without needing extensive downloads from CAs.

Challenges with Browser Support for OCSP