>> Common certificate implementation issues.
The learning objective for this lesson
is to differentiate
the most common certificate implementation issues.
Let's get started.
When you're ready to implement
certificates in your own organization,
because there are so many variables to it,
oftentimes we have errors.
This lesson and is a short
lesson but we're going to go over
the most common areas where you might have problems
when you're implementing certificates
in your own organization.
The first is the validity date.
Every certificate is issued to be
valid until a certain time.
If you don't renew that certificate until that time,
then it will be an invalid certificate.
You might have seen this when you were
serving to websites,
and then the site did not renew their certificate,
and your browser will let you know that
this certificate has now expired.
Wrong certificate type.
We can generate certificates for specific purposes,
and when we generate it for one purpose
but we use that certificate for something else,
it's going to give us problems.
Revoked certificates.
If your certificate appears on
a certificate revocation list it's not going to work.
Now, it doesn't
always mean that something bad happened,
it could have been that certificate
was revoked by accident.
Someone was cleaning house and revoke
the wrong certificate, this does happen.
If you're having problems with yours and you're getting
errors that indicate a revoked certificate,
check your CRL to find out and then take it from there.
We could also use incorrect names.
If we were to purchase a certificate
for a website, for example,
and we choose it for abc.com,
but we're actually using
abcc.com, it's not going to work.
Another example of this would be if
we didn't purchase a wildcard certificate,
we just purchased a certificate
for specifically abc.com,
but then we try to use that certificate for
mail.abc.com it's not going to work.
We could have chain issues.
The certificate chain has to be valid all the
way through from the root to the subordinate,
and then the leaf certificates.
If any part of that chain is not valid,
then the certificate is not going to work.
You could also have issues
with a self-signed certificate.
This is where it is not created
and endorsed by a trusted third party,
it is something you created and signed yourself.
The study guide will tell you this is
similar to a fake ID.
For most purposes I don't
agree with this because there are
many legitimate reasons we would
want to use self-signed certificates,
but for the purposes of
authenticating yourself to another party,
then yes, this would be similar to a fake ID.
Weak signing certificates.
These are weak or deprecated
hashing algorithms that were
used in the creation of the certificate.
Similarly we can also have
weak cipher suites where we're using
week or deprecated cipher suites
that have been used when that certificate was created.
We also have incorrect permissions.
If we put the files that are necessary for
the certificate on a web server, for example,
and then we don't place the proper permissions
on the files and
the web server is not able to
access those files, we're going to have errors.
Mismatch keys is when we use
the wrong key pair to decrypt data.
One key pair was used to encrypt it
but we're trying to use another to decrypt it.
Improper key handling is when we're not
securing the private or our symmetric keys.
This can lead to a breach or it could
be that just calling into question of
whether or not our data is now secure because we don't
know if those keys were handled
improperly outside of our control.
If we didn't secure them,
then we can't be sure that they haven't been used.
Embedded keys are those that are etched into
a specialized crypto storage chips
and these are read-only.
If you're using something that
needs access that's more than read only,
you need to keep this in mind.
Rekeying, the session keys are
renegotiated during a communication session.
This is done often so that we can make sure that
one key is not used to encrypt
all the data that's going through.
Now, often this is triggered
because the data volume reaches
a certain threshold rather
than an amount of time has passed.
Crypto shredding, this is when we
destroy the key that was used to encrypt data.
This will destroy access to the data
because if we don't have a key to decrypt it any longer,
then that data is destroyed,
no one can get to it.
But it's very important we make
sure that when we're destroying these keys,
that those keys themselves cannot be recovered,
and this is especially important
for cloud implementations.
Cryptographic obfuscation, this is when we
transform protected data into an unreadable form,
and this is usually used for storage.
A good example of this is the Linux ETC shadow file.
Key rotation is when we
revoke a key and issue a new one,
and we do this through a periodic basis.
We do that because we're trying to
prevent brute force attacks on the keys.
If the key is changing,
it makes it harder for that key to be attacked.
Compromise keys, this is when we had
unauthorized access to our symmetric key
or our private keys.
Because of this, you consider you've
been breached and it's time to revoke
and reissue keys. Let's summarize.
We discuss common digital certificate issues
along with common cryptographic key issues,
so let's do some example questions. True or false.
Crypto shredding turns protected data
into an unreadable format for storage.
False, cryptographic obfuscation does this.
Crypto shredding is the destruction of
the decryption key that was used to encrypt the data,
and by doing that we've made the data unusable.
Question 2, blank is purposely
changing keys to protect against brute force attacks.
Key rotation. Question 3.
This type of issue occurs
because an expired certificate has
been used. Validity dates.
Finally Question 4,
these keys are etched into
specialized cryptographic devices that are only
available as read-only. Embedded keys.
Hope this lesson gave you
some ideas on some areas you could look for if
you're having problems with
certificates in your organization,
and keep these in mind for the test
because they're generally going to ask you just
those little these types
of questions where just to make sure
you understand how you would go about troubleshooting
these problems. I'll see you in the next lesson.