Managing Public Key Infrastructure (PKI)

Install a Certificate Authority (CA) Hierarchy

Harden a Certificate Authority
Back Up a CA
Restore a CA

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 1

 Digital Certificates

Public key

Credentials

User with certificate

Device with certificate

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 2

 Certificate Authentication

CA
Issues certificate Validates and
accepts certificate

Presents
certificate

Certificate Resource
holder

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 3

 PKI

CA issuing
server certificate

CA issuing
user certificates

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 4

 PKI Components

Certificate CA

Certificate Certificate
RA
Database Management System

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 5

 CA Hierarchies

Parent-child

Trusts within
hierarchy
Parent-child

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 6

 The Root CA

Self-signed certificate

Root CA

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 7

 Public and Private Roots

Private root CA Public root CA

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 8

 Subordinate CAs

Root CA

Subordinate CAs

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 9

 A Centralized Hierarchy

Root CA

User with certificate

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 10

 A Decentralized Hierarchy

Root CA

Issuing CA

Users with certificates

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 11
 Certificate Policies

What information a certificate will contain

Requirements to obtain a certificate
Uses of certificates

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 12

 Multiple and Dual Key Pairs

File encryption Digital signing

File encryption
Digital signing

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 13

 The Certificate Life Cycle

Root issues self-signed

1
certificate

2 Certificates are enrolled

3a Certificate is renewed 3b Certificate is revoked 3c Certificate expires

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 14

 CA Vulnerabilities

Unauthorized users
Physical security
Private keys

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 15

 Hardening a CA

Secure CA, keys, and certificates while

maintaining certificate services
Follow hardening guidelines
Requirements will vary

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 16

 Reflective Questions

1. What types of CAs are you familiar with?

2. Have you been involved in implementing a PKI? Explain.

Copyright 2005 Element K Content LLC. All rights reserved. OV 6 - 17