Certificates & Trust Flashcards
Digital certificates that are signed by the entity that issues them rather than by a trusted Certificate Authority (CA). They provide encryption for data transmission but lack third-party validation, making them less secure for public-facing applications.
Self-Signed Digital Certificates
A digital certificate used to authenticate the identity of a client (e.g., a user or device) to a server. It is often used in mutual TLS to establish trust between both parties.
Example: A VPN client uses a this type of certificate to authenticate itself to the VPN server before access is granted.
Client Certificate
A digital certificate that provides the highest level of assurance and requires rigorous verification of the organization’s identity before issuance. It typically displays the organization’s name in the browser’s address bar for enhanced trust.
Example: An e-commerce website uses an this certificate to display the organization’s verified name in the browser’s address bar, assuring customers of its legitimacy.
Extended Validation (EV) Certificate
A digital certificate issued to a server to enable secure communication, such as HTTPS. It authenticates the server’s identity and facilitates encryption between the server and its clients.
Example: A web server hosting an online store uses this certificate to secure customer data during transactions.
Server Certificate
A type of SSL/TLS certificate that secures a domain and all its subdomains with a single certificate. It uses a wildcard character (*) to apply to all subdomains.
Example: This certificate for *.example.com secures www.example.com, mail.example.com, and blog.example.com.
Wildcard Certificate
Digital certificates issued by a trusted Certificate Authority (CA) to authenticate the identity of an organization or individual and establish secure communication. They are widely trusted because they are validated by a recognized third-party authority.
Example: A business uses a this digital certificate from a trusted CA like DigiCert to secure its website and enable HTTPS.
Third-Party Digital Certificate
A foundational element in a security architecture that provides a trusted starting point for verifying the integrity and authenticity of a system. It is typically implemented in hardware and ensures that cryptographic keys, firmware, and software are secure.
Example: A Trusted Platform Module (TPM) acts as this, storing cryptographic keys used for secure boot and encryption.
Root of Trust
The framework used to establish, manage, and validate trust relationships in a Public Key Infrastructure (PKI). It defines how Certificate Authorities (CAs), users, and certificates interact to ensure secure communication.
PKI Trust Model
A simple PKI model where a single Certificate Authority (CA) issues all certificates and directly establishes trust. It is easy to manage but has a single point of failure.
Example: A small organization uses this to issue certificates for internal systems.
Single Certificate Authority (CA) Model - PKI Trust Model
A PKI model with a root CA at the top, which certifies intermediate CAs. Intermediate CAs issue end-user certificates. This model improves scalability and security by isolating root CA operations.
Example: A corporate PKI system where this model delegates certificate issuance to intermediate CAs.
Hierarchical Model
A decentralized PKI model where multiple CAs cross-certify each other, allowing certificates from different CAs to be trusted across systems.
Example: Two companies with separate CAs set up a mesh model to trust each other’s certificates during a collaboration.
Mesh model (cross-certifying CAs)
A decentralized trust model where all CAs act as root CAs, and trust is established by mutual endorsements or signatures among users.
Example: PGP email encryption relies on a this model, where individuals manually verify and sign others’ keys.
Web of Trust Model
A PKI model where multiple CAs form a sequential chain, with each CA certifying the next one in the hierarchy. The trust begins with the root CA and extends through the chain.
Example: A certificate validated by following this model back to the root CA.
Chain of Trust Model
A trust model that connects separate PKI infrastructures via a “Bridge CA” to facilitate interoperability. The Bridge CA cross-certifies participating PKIs.
Example: Government agencies with independent PKIs uses this model to share certificates securely.
Bridge Model
A flexible PKI model combining features from hierarchical, mesh, and bridge models to meet complex organizational needs. It offers scalability, redundancy, and flexibility.
Example: A multinational company uses this model to integrate regional hierarchical PKIs with a mesh model for inter-region trust.
Hybrid Model
