TKI is another method for implementing cryptography.
It is based on digital certificates that can be used for authentication and encryption API is built
from a certificate authority to identify the organization that owns the digital certificates certificate
authorities handle certificate signing requests for devices participating in the environment every certificate
authority has a root certificate that is used as the main top level certificate once a certificate has
been generated.
It can be used to sign all intermediate and client level certificates.
Once a client trusts a PCI certificate then it will also trust all the certificates signed by that CAA
to retrieve a signed certificate from a certificate authority.
Now what devices can manually generate certificate assigning requests certificate assigning requests
contain information about the network device like a few Deann which stands for fully qualified domain
name.
The CSR will also contain detailed information about the organization that owns the certificate.
When CSR is generated a public and private key pair are created.
Once the CSR is generated it can be submitted to the certificate authority to be signed.
Once the network device receives the science certificate it can be installed.
So you can see a CSR actually be generated on a network device.
I'm logged into a Windows web server and we have the option to create a certificate signing request.
So first we have to answer the common name which is going to be the hostname of the server.
So if the server's name is web dot Cisco dot com.
And that's what we're going to want to enter for its common name
the full DNS name of the server is where I've got carried out home.
Organization will say home I.T. say San Jose
San I've entered the information required for the CSR.
Next I want to say the bit laying out solid 2048
that we have to send the file somewhere I'll just send to the desktop and call it whatever CSR.
So now the CSR is on my desktop I open it up this is what the certificate signing request looks like.
This tax can actually be used to manually fulfill the certificate signing request on the certificate
authority server.
I'm going to copy that.
Now to fulfill my certificate sign request and get it signed by my certificate authority I have web
browsers to my certificate authorities IP address with the search serv path.
Since this is a Windows certificate authority I'm going to say request a certificate.
This will be a advanced certificate request paste in my tax from my CSR that I generated on my web server
and since this is a web server I'm going to select the web server certificate template submit and now
I have the option to download my certificate.
I'm going to choose based 64
saved to my desktop
and take the certificate.
Go back to my web server
and now I have the option to complete certificate request to ask for the file name.
I don't call this web traffic.
There you go.
Now I have completed my certificate request you can see it was issued by my Active Directory root certificate
authority.
And now if I wanted to I get assigned the certificate as my web servers identity certificate for any
age to keep us secure connections.
In addition to a manual CSR there is a protocol available called up simple certificate enrollment protocol.
Some requests are sent via HTP over the network and providing a way for network devices to automatically
retrieve a certificate without manual intervention.
Once the network device has a signed certificate it is considered to be an identity certificate identity
certificates can be used as a credential for authentication and to encrypt data.
All identity certificates have an expiration date to control the validity of the certificate.
So how do you network devices use certificates.
Let's first talk about how they can be used for encryption.
A great example is a secure web server web servers that are accessed via aist ass.
Use their identity certificate to encrypt data for data exchanges with web clients.
The server first response to the client request with its public key and certificate.
If the client trusts the CAA that signed the Web servers identity certificate then the client continues
to communicate and sends encrypted data back to the server using the public key to encrypt the data
data that is encrypted with a of ISIS public key can only be decrypted with the associated private key
which is only known by the server.
This has been an example of asymmetric encryption since different keys were used for encryption and
decryption within the asymmetric encryption exchange asymmetric key is secretly created which then can
be used to create a secure encrypted channel for the HTP session between the client and server.
Let's take a look at a real world example of how a certificate can be used by a secure web server to
encrypt a session.
When we go to secure web sites with HTP as our web browsers have trusted root certificate authorities
that they use to validate certificates that are sent in responses from secure servers.
So if I go to my certificates store on this web browser and go to trust the root certificate authorities
Here's the certificate authorities that my Google Chrome web browser trusts.
So if I go to a secure Web site and the secure web server certificate that it presents was signed by
one of the certificate authorities then my web browser will trust the certificate and allow the connection.
And as you can see here usually you'll see a green certificate icon letting you know that your web browser
trusts the certificate that the web server has responded with.
So of course Google would be in my trust the root store.
So if I click on that go to details I can actually view the certificate that Google responded with.
So you can see that the certificate was issued to www.youtube.com issued by the Google Internet authority
and the certificates valid until March of 2017.
And then if you look at the details we can see some encryption algorithm information.
And typically the actual name that the web browser is looking for the match for is with the subject
or the sand field.
So for example if I put in the IP address of Google dot com instead of this few Deann then the web browser
would not consider the certificate to be trusted because when I put in the web browser did not match
what the certificate was provision for.
So I always know that you got your host name that you put in your you are able to match what the certificate
is set for so that your web browser trusts the certificate.
And we look at the certificate path you can see the root certificate authority than the intermediate
authority.
So the root sign a search for this Google Internet authority G-2 and then this intermediate authority
actually sign of the identity certificate that the Google web server is using.
Next let's talk about how certificates can be used for authentication.
An example would be for VPN connections if a VPN client sends a certificate as its credentials.
DPN Gateway's can authorize the VPN connection if it trust the CAA that sign the client certificate
username is within client certificate subject names can also be used for differentiated access.
So for example the VPN gateway could have an access rule that only allows the user Jadot to access routers
on the network through VPN connections.
If a certificate was assigned to Jadot then their username would be within the certificate information
and could be used to receive the special access
to police of certificates are still valid or not.
Certificates can be checked against a revoke Haitian list.
And if a certificate has been revoked by a certificate server then certificates can be denied by devices
like firewalls that are checking for authentication access
certificates can be created in many formats based on a subdural public key cryptography standards.
This list of standard should be known for the exam.