>> Building on our last two lessons,
we said that before bank provides online banking,
it goes to a certificate authority
and it obtains a digital certificate.
Then the bank installs that certificate on
its web server so that when
a client requests a secure connection,
the bank provides that certificate.
Let's talk about certificates
>> a little bit more in depth.
>> But first, I want to talk about driving,
and you'll see the parallels in just a few minutes.
Maybe you've had this experience or maybe you haven't.
But if you have what we call lead fight,
you may have been pulled over for speeding before,
and you know that when an officer
pulls you over for speeding,
he'll typically ask you for
your driver's license and registration.
While you are looking for those things,
he will probably ask you your name.
Now, wouldn't you agree
that the name you should give should
probably match the name that
appears on your driver's license?
Otherwise, you might have a problem on your hands.
The next thing he would likely check is
that the license is not expired,
and then the next thing he checks for is the class.
This is an indication on the type of
vehicle you are authorized to drive.
Then he's likely to check the serial number on
your license so that way he can
look it up and make sure it's not revoked.
The reason he knows what information
he can find on the driver's license
and where it will be is that
the driver's licenses are standardize,
that way regardless of what state you are in,
the license should be accepted and
understood anywhere in the United States.
Then the last thing the officer might do is
tilt the license back and forth in the sunlight.
Why does he do that? Well,
he does that so you can see the hologram or watermark.
That tells him that the license was
issued by a trusted authority,
and if it doesn't have that,
it's a strong indication that it's counterfeit.
If there is no way to be sure it was
issued by a trusted authority,
then nothing on that license really matters.
This is exactly the way certificates work in the PKI.
Then the folks at Bank of America
go get a certificate from
Verisign or whoever is their certificate authority,
the name of that server will be on the certificate.
That's how you would know that you
are connected to the right server.
It shouldn't be an expired certificate.
It also has a class.
The higher the class,
the more authorized the certificate should be.
Meaning a class 1 certificate
only indicates a match with an email address.
Whereas if you get to class 3 or 4,
you get digital signing and
other rights and trust levels.
Now, it will also have a serial
>> number or license number
>> that'll be used to determine whether
the certificate has been revoked.
We'll see that in a few minutes.
Is it standardized?
Yes. The standard for digital certificates is X.509.
You'll need to know that standard for the test.
Then the last piece is,
was it issued by a trusted authority?
Yes, and it is
digitally signed by that certificate authority.
Certificates have a lot in common with
driver's licenses. Let's look at one.
You can see this digital certificate
which follows the standard of
X.509 and you can
see some of the fields on the certificate.
You can see the public key there
and if I scroll up on this screenshot,
you'd be able to see the name and the expiration date.
You can see that it's digitally signed
using SHA1 and RSA,
and this is how a server authenticates its SSL or TLS,
and proves who it is.
It provides it the public key that is
issued by a trusted authority and you know
that because it's hash and the hash is
encrypted with that trusted authorities' private key.
When your public key can decrypt that hash,
you know it came from a trusted authority.
The heart and soul of public key infrastructure
is the certificate authority
because the trust and the certificate
comes from the trust and the certificate authority.
Now, there's some other elements
that make up a public key infrastructure.
The certificate authority is
>> the most important element.
>> There are also registration authorities, or RA,
which takes some off
the off-loaded work from the certificate authority.
Verisign might hire a company
to do the verification and checks,
and that company would be the RA.
In our bank scenario,
when the bank provides us all of
its proof and documentation,
there might be an RA that does that verification,
but only the CIA can issue the certificate.
There's also a certificate repository.
Your browsers, where you hold digital certificates
for Verisign and all the other trusted authorities.
That's the certificate repository.
Then also traditionally,
there have been a certificate revocation list or CRL.
The clients have had to download to verify whether
the server certificate is valid and
>> hasn't been revoked.
>> In a few minutes, we'll see how
>> this has been modernized.
>> For a longtime clients had to download
the entire CRL and verify
certificates revocation status every
time they received a certificate.
Now since then, we've evolved past that.
We're now dealing with a protocol called OCSP,
online certificate status protocol.
Now OCSP has mean it more streamlined
to determine a certificate's revocation status.
What happens is that the certificate authority will
publish the CRL on a regular basis.
It's the job of the OCSP responder to pull
from the CRL periodically throughout the day.
When my client goes to the OCSP server
and asks whether the certificate has been revoked,
the OCSP responder will
indicate whether it has been revoked or not,
as of the last time that it was updated.
To recap, you have certificate authorities
and registration authorities,
both are involved in getting
the client or server a certificate.
Certificates are used to authenticate.
The trust of a certificate is based on
the trust of the certificate authority.
We have the CRL and the OCSP
to make sure that certificates are up-to-date.
That pretty much wraps up public key infrastructure.
Keep in mind that this is a lot of
overhead and takes a lot of effort to maintain,
and as we will see,
this can be too much overhead for some organizations.