PKI 102 – Digital Certificates

1. Digital Certificates

One of the most important things when it comes to crytpography is authentication which is the process of verifying that an entity really is who it claims to be. In modern cryptography this is usually done through a digital certificate.

A digital certificate binds an entity’s identity with a public key. The binding is performed by a Certificate Authority (CA) through the process of signing.

1.1 Generate a key pair

The process of getting the certificate signed starts with an entity generating a key-pair.

1.2 Create a Certificate Signing Request (CSR)

The next step for the entitiy is to create a Certificate Signing Request (CSR) which will contain the public-key, the identity information, the Distinguished Name (DN) for which it requests the certificate and a section which is generated using the private-key. That is to say the private-key is not part of the CSR but it is used to sign the CSR in order to attest that the request comes from the owner of the public-key.

1.2.1 Creating a CSR using openssl

If you don’t have an existing Private Key you can generate the key and the CSR in the same stept using:

Additional identity information will be asked from the user. These make up the DN(Distinguished Name). You can suppress these questsion by providing the reqiured information using the -subj argument.

The Common Name (FQDN) is important because this value will have to match your web server address when you you plan to use the certificate for this.

The challenge information requested at the end of the CSR is a password that will be shared between you and the CA.

1.2.2 Creating a CSR using a config file

For more advanced requests, you can use a config file to provide the input for the CSR. This example will also show how to use SAN(Subject Alternative Names) certificates. A SAN is another name that your identity will be certified for. It’s like having multiple different CN. It’s not the same as a wildcard certificate.

The config file should follow this format:

Of course, you should replace the values provided for desitnguished name, common name and alt name. After that, generate the CSR with:

1.2.3 Reading the contents of a CSR

To read the contents of a CSR you can use:

1.3 Signing the CSR and generating the certificate

1.3.1 CA signed Certificates

The CSR could go through a Registration Authority (RA) that verifies the identity of the entitiy against the provided CSR before reaching the Certificate Authority (CA) for signing. Most of the times, RA and CA are the same so it all looks like a single step.

To sign the request, a CA owner should use this command:

1.3.2 Self Signed Certificates

Instead of going through a CA, you can also sign your own requests and generate a “self-signed certificate”. That’s the easy way, but also less trusted. By default self-signed certificates are not trusted by most modern browsers.

To sign a CSR (and get a self-signed certificate) you can use the following openssl command:

After it is signed, the certificate is exported to the requester. The standard for these certificates is registered as X.509 but there are different formats for the certificate (.pem, .p12, .cer, .crt and others). The p12 format allows adding an additional passphrase to the certificate so it is not readable without knowing the passphrase.

To decode the information of a crt file you can use:

1.4 Chain of Trust

A certificate chain is a list of certificates that have the following characteristics:

  • The issuer of each certificate matches the subject of the next certificate in the list.
  • The private-key used to sign each certificate can be verified using the public-key of the next certificate in the list
  • The last certificate in the list is trusted through other methods (manually set to trust, embedded in the system, etc)

By using this chain of trust, the certificate provided by an entitiy is verified by another entity and the chain goes from the certificate under verification, through intermediate certificates, up to the CA’s root certificate.

In some simple scenarios you can provide your own certificate by performing the signing process yourself. In this case the certificate is called “self-signed” but others may not have a high level of trust in this kind of certificate.

Web browsers usually include intermediate certificates provided by well-known CAs and set to trust in order to enable the verification process to take advantage of the chain up to the well-known CAs without passing their root certificates to the public.

A useful command to check the certificate of a website is:

Leave a Reply

Your email address will not be published. Required fields are marked *