Digital Certificates

Question 1

Digital Certificate

Answer 1

• Digitally signed electronic document that binds a public key with a user’s identity

Question 2

Wildcard Certificate

Answer 2

• Allows all of the subdomains to use the same public key certificate and have it displayed as valid

Question 3

Subject Alternate Name - SAN field

Answer 3

• Certificate that specifies what additional domains and IP addresses are going to be supported

Question 4

Single-Sided Certificate

Answer 4

• Only requires the server to be validated

Question 5

Dual-Sided Certificate

Answer 5

• Requires both the server and the user to be validated
• Only used in high security environments, as it takes up more resources

Question 6

Self-Signed Certificate

Answer 6

• Digital certificate that is signed by the same entity whose identity it certifies

Question 7

Third-Party Certificate

Answer 7

• Digital certificate issued and signed by a trusted certificate authority (CA) - They issue the certs
• Usually embedded by browser

Question 8

Root of Trust

Answer 8

• Each certificate is validated using the concept of a root of trust or the chain of trust
• Implicitly trusting a certificate based on the root hierarchy of the certificate - I.E. Father, Grandfather

Question 9

Registration Authority (RA)

Answer 9

• Requests identifying information from the user and forwards that certificate request up to the certificate authority to create the digital certificate

EXAMPLE: Verisign

Question 10

Certificate Signing Request (CSR)

Answer 10

• A block of encoded text that contains information about the entity requesting the certificate
• This includes… Organization Name, Domain Name, Locality, and Country

Question 11

Certificate Revocation List (CRL)

Answer 11

• Serves as an online list of digital certificates that the certificate authority has already revoked

Question 12

Online Certificate Status Protocol (OCSP)

Answer 12

• Allows to determine the revocation status of any digital certificate using its serial number

Question 13

OCSP Stapling

Answer 13

• Allows the certificate holder to get the OCSP record from the server at regular intervals

Question 14

Public Key Pinning

Answer 14

• Allows an HTTPS website to resist impersonation attacks from users who are trying to present fraudulent certificates

Question 15

Key Escrow

Answer 15

• Occurs when a secure copy of a user’s private key is being held

Question 16

Key Recovery Agent

Answer 16

• Specialized type of software that allows the restoration of a lost or corrupted key to be performed