3.9 Implement Public Key Infrastructure Flashcards
Policies, procedures, hardware, software, and people involved in creating, distributing, and managing digital certificates.
Public key infrastructure (PKI)
What are the 6 steps to the Public key management lifecycle?
Key generation Certificate generation Distribution Storage Revocation Expiration
What is the only way to trust a certificate is valid?
Using the digital signature
When creating a key pair, which key would you send to the CA to be digitally signed?
Public key
What kind of organizations almost always should have their own internal CA?
Medium to large organizations with 100s of servers
What is the best way to provide redundancy to a CA infrastructure?
Make it hierarchical
What is the registration authority? (RA)
RA identifies and authenticates the requester
Responsible for cert revocations
The fully qualified domain name (FQDN) for a website on a certificate.
Common name (CN)
What is the subject alternative name (SAN) on a website certificate?
additional host names for the site (i.e. www.google.com and google.com)
What is the CRL that is maintained by the CA?
Certificate revocation list
A check that is done by your browser to check for a certificate revocation without downloading the entire CRL.
Online Certificate Status Protocol (OCSP)
The certificate that lies at the start of the PKI infrastructure. All subsequent certificates will branch off of this one.
Root certificate
When do you use self-signed certificates?
When you don’t need to distribute the certificate externally
What is the standard used when working with certificates?
X.509 Standard
Encoding format designed to transfer syntax for data structures, and is perfectly suited for certificates. Represented in binary format.
Distinguished Encoding Rules (DER)
Container format for storing multiple certificates or keys in a single container. Derived from Microsoft’s .pfx format
PKCS #12`
What’s the benefit for keeping one or more CAs offline?
Easily recover if an intermediate CA is compromised
This provides scalability to OCSP process of certificate revocation checking. Allows OCSP status information to be sent with the SSL/TLS handshake.
OCSP stapling
Process of adding a certificate or public key to an application the first time it runs so you can compare it with the cert on the server.
Pinning
PGP is a web of trust. What does this mean?
There is no central CA. Certificates are signed and trusted within the network
What is it called when a third party manages your private keys?
Key escrow
Allows you to see and validate all certificates between the server issuing a certificate and the root CA.
Certificate chaining
