Certificates 1.4

Question 1

Digital Certificate

Answer 1

• A digital file sent as an attachment to a message.
• Verifies the message came from trusted sender.
• Establishes an association between the subject’s identity and the public key.

Question 2

Public Key Certificate

Answer 2

• Binds a public key with a digital signature and other details about the key holder.

Question 3

Public Key Infrastructure

Answer 3

• Provides all the components necessary for different types of users and entities to be able to communicate securely in a predictable manner.

Question 4

Certificate Authority (CA)

Answer 4

• Trusted authority that certifies individual’s identities and creates electronic documents verifying their identity.

Question 5

X.509 Format

Answer 5

• Standard format of certificates.
• Outlines the necessary fields of a certificate and the possible values that can be inserted into the fields.

Question 6

X.509 Certificate Details

Answer 6

• Serial number, version, signature algorithm, issuer, name of of the cert holder, public key, extensions, thumbprint algorithm, and thumb print.

Question 7

Root of Trust

Answer 7

• An inherently trusted component.
• Hardware, software, firmware, or other components.
• Hardware security module, secure enclave, certificate authority

Question 8

Certificate Signing Requests (CSR)

Answer 8

• Actual request to a CA containing a public key and requisite information needed to generate a certificate.
• Contains all the identifying information that needs to be bound to the key.

Question 9

Self-Signed Certificates

Answer 9

• Internal certificates don’t need to be signed by a public CA.
• Companies creates its own root node by creating its certificate chain.

Question 10

Subject Alternate Name (SAN)

Answer 10

• Extension to an X.509 certificate.
• Lists additional identification information.
• Allows a certificate to support many different domains.

Question 11

Wildcard Certificates

Answer 11

• Include an asterisk and period before the domain name.
• Includes a SAN

Question 12

Certificate Revocation List (CRL)

Answer 12

• A list of serial numbers of certificates that have been revoked.
• Maintained by the Certificate Authority (CA).
• Expired certificates not the same ones as being revoked.

Question 13

Online Certificate Status Protocol (OCSP)

Answer 13

• A request and response protocol that obtains the serial number of the certificate that is being validated and review CRLs for the client.

Question 14

OCSP Stapling

Answer 14

• Sending status of the certificates on the web service itself.
• This is sent through the SSL/TLS handshake.
• Uses a digital signature by the CA.