Chapter 6 PKI Flashcards by Kerry Gambrel

What is a PFX/.pfx extension?

or .p12 extension is used to export a certificate along with its private key. The file is password protected and can archive or transport a private key.

How well did you know this?

Not at all

Perfectly

What is a P7B extension?

extension bundles multiple certificates into a single file. It is used to deliver a chain of certificates that are trusted by the processing host. It does not contain a private key

How well did you know this?

Not at all

Perfectly

What is a CER?

an actual certificate that contains information about the subject like name and location. It is written in either binary DER or ASCII PEM data.

How well did you know this?

Not at all

Perfectly

What is a CRT?

is the same as a .cer file extension. It is a basic certificate that contains information about the subject

How well did you know this?

Not at all

Perfectly

How do public root certificates work?

Allow users to trust a website using the chain of trust to the root authority. Private organizations must load employee web browsers with internal root certificates to verify internal websites

How well did you know this?

Not at all

Perfectly

What is Domain validation?

proving the ownership of a domain, which may be proved by responding to an email to the authorized point of contact. This process is highly vulnerable to compromise

How well did you know this?

Not at all

Perfectly

What is the typical lifespan of a certificate

10+ years

How well did you know this?

Not at all

Perfectly

When is a certificate usually renewed

Before it expires

How well did you know this?

Not at all

Perfectly

What is meant by a certificate being rekeyed

When a new key is generated

How well did you know this?

Not at all

Perfectly

What is stapling?

Mechanism used to mitigate performance and privacy issues when requesting certificate status from an OCSP responder

How well did you know this?

Not at all

Perfectly

How is stapling used in securing privacy with OCSP?

by having the SSL/TLS web server periodically obtain a time-stamped OCSP response from the CA. When a client submits an OCSP request, the web server returns the time-stamped response, rather than making the client contact the OCSP responder itself.

How well did you know this?

Not at all

Perfectly

What is pinning?

refers to several techniques to ensure that when a client inspects the certificate presented by a server or a code-signed application, it is inspecting the proper certificate

How well did you know this?

Not at all

Perfectly

How is Pinning implemented?

By embedding the certificate data in the application code. or by submitting one or more public keys to an HTTP browser via an HTTP header, which is referred to as HTTP Public Key Pinning (HPKP)

How well did you know this?

Not at all

Perfectly

What is distinguished Encoding Rules (DER)

The binary format used to structure the information in a digital certificate. Like Cryptographic data-both certificates and keys

How well did you know this?

Not at all

Perfectly

What is ASCII

7-bit code page mapping binary values to character glyphs. Standard ASCII can represent 127 characters, though some values are reserved for non-printing control characters.

How well did you know this?

Not at all

Perfectly

What is a convention?

A three file character file extension

How well did you know this?

Not at all

Perfectly

What convention is widely used for ASCII format files in Linux

.PEM

How well did you know this?

Not at all

Perfectly

What does PKCS #12 format allow you to do?

export of the private key with the certificate.

How well did you know this?

Not at all

Perfectly

On windows what extension would a PKCS #12 format have?

.PFX

What is the command to create a RSA key pair in Linux?

openssl genrsa -aes256 -out cakey.pem 4096

What are the steps to configure a Root CA?

Setup a directory structure and adapt an OpenSSL config file
Create an RSA key pair
Use the RSA key pair to generate a self-signed root X.509 digital certificate

What are the steps to configure a Certificate Signing Request?

1.Create a CSR with a new key pair
2.Complete the prompts
3.Transmit the CSR file to the CA server
4. On the CA run the command to sign the CSR and output the X.509 certificate
Transmit the .pem file to the web server and update the server config to use it and the private key

What do you do when you have a certificate that has been working previously but doesnt work now?

Check that the cert. has not expired or been revoked or suspended

If you have a problem with a new cert. What should you do?

Check the key usage settings are appropriate for the app.

Check that the subject name is correctly configured and that the client is using the correct address

What do you do when troubleshooting a Cert. that is correctly configured but isnt working

Check the clients have been configured with the appropriate chain of trust. Verify that the time and data settings are a common cause of cert. problems

What is a Digital Certificate

Assertion of identity

In Public Key Infrastructure, when you want others to send you confidential messages how do you go about doing that?

You give them your public key to use to encrypt the message. | The message then can only be decrypted by your private key

In Public Key Infrastructure When you want to authenticate yourself to others. How do you do it?

You create a signature and sign t by encrypting the signature with your private key. You give others your public key to use to decrypt the signature.

What is certificate chaining or Chain of trust?

When every leaf certificate can be traced back to the root

What can find in a Certificate Signing Request?

Info that the subject wants to use in the cert. and its public key

What is a Registration Authority (RAs)?

Entities that complete identity checking and submit CSRs on behalf of end-users, but they don't sign or issue certs.

What is a digital certificate?

A wrapper for a subjects public key and also stores info about the subject and the certs issuer or guarantor

What is Public Key Cryptography Standards (PKCS)?

Series of standards defining certificate authorities and digital certificates

If a new subdomain is added to a cert. Do you need to make a new cert to add the new subdomain?

Yes, unless the Certificate is using a wild card symbol to compensate for all subdomains including new ones

What does it mean when an extension is tagged as critical

The application processing the cert. must be able to interpret the extension correctly

How does Domain Validation work?

By responding to an email to the authorized domain contact or by publishing a text record to the domain

Identification

Creating an accountant od ID that uniquely represents the user, device, or process on the network

Authentication

Proving that a subject is who it claims to be when it attempts to access the resource

Authorization

Determining what rights subjects should have on each resource, and enforcing those rights

Accounting

Tracking authorized usage of a resource or use of rights by a subject and alerting when unauthorized use is detected or attempted

Authentication, authorization, and accounting (AAA)

A security concept where a centralized platform verifies subject identification, ensures the subject is assigned relevant permissions, and then logs these actions to create an audit trail.

knowledge factor (logon)

Passwords/PIN something you know in oreder to authenticate yourself

What is an ownership factor

Something you have The account holder possesses something that no one else does such as smart cards, fobs, or wristbands programmed with a unique identity cert.

What is a Biometric factor / Something you are

Uses either physiological identifiers, such as a fingerprint or behavioral identifiers,

Multifactor Authentication (MFA)

An authentication scheme that requires the user to present at least two different factors as credentials

Two-Factor Authentification (2FA)

combines either an ownership-based smart card or biometric identifier with something you know