In the hierarchical model that will now focus on the certificate from the root certification authority
is the basis of our trust relationship above.
We see a few certificates which for the moment we don't trust.
Let's take a look at a sample certificate.
It can be seen that this is a certificate that is not trusted.
It was issued to someone who was presented as the administrator.
We can see that it was issued by a certification authority called subkey.
We can also see that the certificate is valid for two years from the date of issue.
Let's look now at the details of the certificate.
We have information that this is the third version of the x 5 0 9 protocol.
We see the serial number of our certificate the algorithm that is used for the signature.
In other words confirmation of the authenticity of the certificate and the date of the organization
that issued it.
We already saw the expiration date.
We can also see to whom the certificate was issued in this case.
It turns out that this is the administrator of the domain M-S that P.L..
We also find here the public key in this case the RSA key with the length of two kilobytes in each certificate
is a public key from the earlier module.
We know that public kids should be publicly known.
There must be some method of distribution or automatic submission of requests to view and download public
keys of various people.
That can be recorded in the certificates.
We also find out about the template that was used for the basis for issuing this certificate.
Here it's the ESFS recovery.
We suspect that this is a certificate which allows the administrator to recover files encrypted with
FS technology on behalf of users who for some reason lost their keys.
The purpose of the certificate confirms this in this case the purpose of the certificate is file recovery.
This is what the certificate is used for and it can only be used for this so that this would be unequivocal
and operation code is attached to the certificate.
This is a universal operation code which a certificate may be used we also mentioned that we must identify
the supplier and the information about the key we find such data.
We also need to be able to check whether the certificate has been withdrawn or not.
Each certificate must contain at least one location of the certificate revoked and list.
There is also at least one piece of information where you can download the certificate issued by the
certification authority.
We check in this way if in fact a given certification authority issued this is actually although we
have a chance to see the details of each certificate
here the Certification Path is not yet shown.
In that case let's see what the root certification authority looks like.
The curious thing here is that the issuer and recipient of the certificate are the same somewhere.
This relationship of trust must begin.
Someone must trust himself.
For now this someone trusts only himself.
Now let's look at the certificate of the subordinate's certification authority.
This is a certificate issued by root for subcounty to certification authorities are building a relationship
of trust what changes in the certificates.
If we try to install one of them what will happen if we receive a certificate from some certification
authority and we have decided to trust him.
Let's check.
We should trust the root certification authority after installation of the certificate on our computer
we now trust that certificate.
Let's see what's changed in this certificate issued by the certification authority to someone else someone
who didn't want to trust it turns out that we also trusted the relationship of trust as trans..
This is the basis of the hierarchical structure trusting the root cause certificate means that we use
trust all certificates issued by this authority in the case of the administrator certificate we don't
have full access because we're not able to verify his certificate for our demonstration purposes we
use certificates issued by certification authorities which are currently not available from our computer
as we can see.
We have a warning that although the certificate is issued by someone whom we know we're not able to
verify this the certificate could have been revoked in the meantime.
We did not have this problem in the case of the subordinate's certification authority but we'll talk
about that later.
We already know what certificates in accordance with the x 5 0 9 standard contain.
We had an opportunity to very accurately investigate all files recorded in this certificate.
We have also seen that certificates are digitally signed by the certification authorities issuing them.
We know that changing a digitally signed document will automatically invalidate the signature.
We know how to verify digital signatures.
The contents read from the details of the certificate are reliable.
No one could alter them on their own.
The recipient of the certificate cannot for example change the purpose of or extend the period of its
validity.
Before we analyze the lifecycle of a certificate Let's go back for a moment to the root certification
authority.
We don't need to have some certificates installed when for example we connect to a bank's website for
some reason we already trust them.
The relationship of trust started somewhere.
Let's think about where
if we had components which are called certificates to the administrative console and they will even
be certificates from our own account.
It turns out that we as a user of a given computer trust quite a large number of certification authorities.
Where did this come from.
This is in trust every computer during installation automatically starts to trust specific certification
authorities.
These are trusted root certification authorities their certificates are on the list in the stores which
are created during installation of an operating system.
Here we have for example certificates associated with Microsoft for example permits authenticating the
code signed by Microsoft here.
Also certificates from the company such as thoughts and assign these are corporations which operate
on the certificate market.
There are publicly available certification authorities
if any company buys now a certificate from Verisign we will trust it because a certificate from the
various signed certification authority is on the list of certificates which our computer automatically
trusts and interesting fact is that a vast majority of the certificates shown are really unnecessary.
If we let 4 or 5 certificates everything would still work in the same way as to date all other certificates
or for maintaining backwards compatibility.
Just in case some of these certificates have even expired some time ago.