A public key certificate is a collection of information attached to an electronic message. It is used to verify that the user sending the message is who he or she claims to be. The following is a list of certificate terminology used in Access Manager:
Certificate authority (CA): An entity that issues digital certificates attesting to the authenticity of the information in the certificate.
Certificate: Public information about the entity identified by the certificate, including the public key. A certificate is signed. The signer of the certificate (a CA), if trusted, verifies the accuracy of the information in the certificate.
Certificate chain: In addition to identifying a user, server, or computer, certificates can validate the identity and trustworthiness of other certificates. A certificate that asserts an identity is signed by a certificate that trusts the contents of the certificate it is signing. The signing certificate in turn can be signed by another certificate, which can be signed by another certificate, and so forth, thus forming a certificate chain. The last certificate in the certificate chain is referred to as the root certificate and is a self-signed certificate.
When a certificate or certificate chain is sent from one computer to another, the receiving computer examines the certificate chain to determine if it can be trusted. To verify certificate trust in a chain, the receiving computer examines its own configuration store to see if it contains a CA certificate that matches the root certificate of the certificate chain. If so, the receiver compares its copy of the certificate with the chain’s root certificate to verify its authenticity.
Certificate signing request (CSR): Requesting a signed certificate is accomplished by sending a CSR to the CA. A CSR is created with information about the person or organization that desires the signed certificate. A public key is also generated and included in the CSR. A private key is also generated, but not included in the CSR.
When the CA receives the CSR, the CA uses it in combination with the CA’s guidelines and practices to establish that the person or organization represented by the CSR is properly identified and authorized as the owner of the information in CSR. The CA creates and signs a certificate that the requesting person or organization can use. The signature of the CA in the certificate is what identifies to anyone who trusts the CA that the entity is who it claims to be. The signed certificate is delivered to its owner, who adds it to the keystore (usually the same keystore where the private key created with the original CSR resides).
Issuer: The CA that issues a certificate.
Intermediate certificate: A subordinate certificate issued by the trusted root specifically for end-entity server certificates. The result is a certificate chain that begins at the trusted root CA, proceeds through the intermediate certificate and ends with the SSL certificate issued to you. Using intermediate certificates adds more levels of security, but does not cause performance, installation, or compatibility issues.
Key: A certificate that also contains a private key.
Key pair: An encyrption technology consisting of a public key (available to everyone) and a private key (owned by and available only to a specific individual or entity).
A key pair is used to encrypt or convert information into a format that is difficult or impossible to read. In a digital signature system, the key pair creates and validates the digital signature. In an encryption system, the key pair encrypts and decrypts the message body.
Keystore: A storage file containing keys, certificates, and trusted roots. Access Manager agents can access keystores to retrieve certificates, keys, and trusted roots as needed.
Local CA: The CA of the administration console’s instance of eDirectory™. Also known as the Organizational CA.
Private key: Used for authentication, data encryption/decryption, digital signing, and secure e-mail. One of the most common uses is sending and receiving digitally signed and encrypted e-mail by using the S/MIME standard.
The public and private keys have the following relationships:
Data encrypted with the public key can be decrypted with the private key only.
Data signed with the private key can be verified with the public key only.
Exposing a public key does not expose the corresponding private key.
Public key: The publicly distributed key.
Self-signed certificate: A certificate whose issuer is itself.
SSL connections: When two computers connect and need to establish trust and a secure connection, certificates are exchanged and an encryption algorithm is established. Public keys shared in the exchanged certificates, as well as the associated private keys (which are not exchanged) are used as part of the encryption algorithm. After security is established, a secure SSL session is established and the two computers are able to communicate securely.
Trusted certificate: The certificate of a known CA. These certificates are self-signed and are recognized as representing a CA that is trusted.
Trusted root: The same as a trusted certificate. A trusted root provides the basis for trust in public key cryptography. Trusted roots enable security for SSL, secure e-mail, and certificate-based authentication. The Identity Server already has a list of trusted certificates installed. These certificates are for root CAs, so they are called “trusted roots.”
Trust store: A keystore containing only trusted roots. Intermediate CAs and end entity public certificates can be part of a trust store.