Certificate server
Certificate servers validate, or certify, keys as part of a Public key infrastructure. Keys are strings of text generated from a series of encryption algorithms that allow you to secure communication for a group of users. Many Web servers, such as Microsoft's Internet Information Services (IIS) or Apache's mod_ssl create keys that after having been validated, can be applied to other servers such as News servers or Web servers. The purpose of this process is to create a way for people to communicate and be reasonably sure that others are not eavesdropping or assuming a false identity.
Contents
X.509 Description
The Internet Engineering Task Force RFC 2459, entitled "Internet X.509 Public Key Infrastructure Certificate and CRL Profile", describes the protocols for the X.509 v3 certificate and X.509 v2 Certificate revocation list as a part of the Internet PKI. According to the RFC, "The goal of this specification is to develop a profile to facilitate the use of X.509 certificates within Internet applications for those communities wishing to make use of X.509 technology. Such applications may include WWW, electronic mail, user authentication, and IPsec." The structure of X.509 and the resulting PKI allows the owner of a public key to be certain, that a private key is owned by the correct person, via the use of public key certificates digitally signed by a certificate authority.[1]
Implementation using Microsoft IIS
Microsoft's Certificate Services on IIS allows a server to issue or revoke digital certificates. The specific implementation requires a dedicated certificate server in one of four configurations as Certificate authorities.
- Enterprise root CA
- Enterprise subordinate CA
- Stand-alone root CA
- Stand-alone subordinate CA
Management of Certificate Services is done via a Microsoft Management Console snap-in, and a web based application. These programs can be used to view revoked, issued, pending, and failed requests for certificates.[2]
Privacy concerns with Microsoft certificates
Lua error in package.lua at line 80: module 'strict' not found. Certificate authentication is built into recent versions of IE and cannot be turned off. Automatic checking of the validity of certificates at Microsoft's certificate authority may provide Microsoft with a database of sites visited, files downloaded, the unique ID of the user's computer, the user's IP address and other information. As such, use of this automated security feature may represent a considerable privacy concern (which may also conflict with existing EU regulations regarding privacy). Most users may be unaware that their identity and specific web browsing habits are being stored centrally via Microsoft's browser and may be subject to subsequently being resold or subpoenaed.
Open source implementations
There exist several open source implementations of certificate servers, commonly referred to as a CA or certificate authority. Common for all is that they provide the services to issue, revoke and manage digital certificates.
Some well known open source implementations are:
- EJBCA
- OpenCA
- OpenSSL, it is really an SSL/TLS library, but comes with tools to use it as a simple certificate authority.
- FreeIPA, which includes Dogtag CA.
Implementation using Apache + mod_ssl
Apache can use a certificate server to get certificates used to provide secure communications with the SSL/TLS protocol.
The server based implementation of the Apache HTTP Server is "mod_ssl", a derivation of Apache-SSL based on the functionality of OpenSSL. Mod_ssl features support for SSLv2, SSLv3, and TLSv1, with X.509 client/server based authentication and certificate revocation. This is accomplished via three packages: the mod_ssl package, an extended API, and an SSL/TLS implementation toolkit such as OpenSSL.[3]
See also
- Certificate authority
- Certificate-based encryption
- Public key infrastructure
- Public key certificate
- X.509
