Please enable JavaScript.

Coggle requires JavaScript to display documents.

Certificate - Coggle Diagram

- - - - PEM (originally “Privacy Enhanced Mail”) is the most common format for X.509 certificates, CSRs, and cryptographic keys.
      - PEM files are usually seen with the extensions .crt, .pem, .cer, and .key (for private keys), but you may also see them with different extensions.
    - - PKCS#7 (also known as P7B) is a container format for digital certificates that is most often found in Windows and Java server contexts, and usually has the extension .p7b
    - - PKCS#12 (also known as PKCS12 or PFX) is a common binary format for storing a certificate chain and private key in a single, encryptable file, and usually have the filename extensions .p12 or .pfx.
    - - DER (Distinguished Encoding Rules) is a binary encoding for X.509 certificates and private keys.
- - - - .key - This is a PEM formatted file containing just the private-key of a specific certificate and is merely a conventional name and not a standardized one. In Apache installs, this frequently resides in /etc/ssl/private. The rights on these files are very important, and some programs will refuse to load these certificates if they are set wrong.
  - - - .pkcs12 .pfx .p12 - this is a passworded container format that can contain both public and private certificate pairs, and certificates of CAs (i.e. chains of certificates). Unlike .pem files, this container is fully encrypted, use openssl or keytool to see its contents
      - binary file
      - used mostly in Windows
      - can contain both PEM certificates as well as private keys in a signle file;
    - - Defined in RFC 2315 as PKCS number 7, this is a format used by Windows for certificate interchange. Java understands these natively, and often uses .keystore as an extension instead. Unlike .pem style certificates, this format has a defined way to include certification-path certificates.
      - can't store private keys
      - used mostly on Windows, certificate is located between ----BEGIN PKCS7------ and ------END PKCS7-----
- - - - Information about how to get the issuer of this certificate (CA issuer access method)
      - Address of the OCSP responder from where revocation of this certificate can be checked (OCSP access method)
      - screen
  - - - DNS Name
        
        CA uses this construct when issuing SSL server certificates. It contains the domain(s) for which this certificate is issued.
        
        DNS name
      - RFC822 Name
        
        It contains an email address of the user whom this certificate is issued. This construct can be present in the document signing, email signing, SSL client authentication certificates etc.
        
        RFC Name
  - - - It contains a key identifier which is derived from the public key in the issuer certificate.
      - The AKI and SKI values are mainly used in certificate path construction in order to identify the right issuer certificate.
      - Authority Key Identifier
    - - Subject Key Identifier
      - contains a key identifier which is derived from the public key in the subject certificate.
      - The key identifier in AKI and SKI is SHA-1 hash of the issuer and subject public key respectively.
  - - - Subject Type = End Entity
      - Subject Type = CA
    - - Certification path
- - - - kontener de facto zawierający właściwą treść certyfikatu i i to tenże podlega faktycznemu podpisaniu przez urąd certyfikujący
      - zawiera
        
        version
        
        obecnie v3
        
        serial number
        
        signature
        
        algorytm kryptograficzny użyty przez CA do podpisania tbsCertificate; powtórzenie pola signature algorithm spoza tbsCertificate
        
        issuer
        
        opis/dane CA w notacji X.500
        
        validity
        
        Subject
        
        dane właściciela certyfikatu w notacji X.500
        
        subject public key info
        
        extensions
        
        rozszerzenia ograniczające sposób korzystania z certyfikatu oraz określające sposób weryfikacji ścieżki certyfikacji
        
        key usage
        
        określa zadanie/cel do jakich certyfikat może być wykorzystany
        
        examples
        
        digital signature
        
        non-repudaition
        
        do jednoznacznego określenia tożsamości podpisującego
        
        crl sign
        
        enhanced key usage
        
        mają postać listy identyfiaktorów OID (Object identifier)
        
        np. Client Authentication - numer OID 1.3.6.1.5.5.7.3.2.
        
        doszczegółowienie Key Usage, bo np. podpisywać moża wiele rzeczy
        
        CRL distribution point
        
        zawiera adres lokalizacji z któej można pobrać listę CRL
        
        Authority Information Access (AIA)
        
        Basic Constraints
        
        sprawdzenie czy właściciel certyfikatu jest użytkownikiem końcowym czy też podmiotem wydającym certyfikaty
        
        rozszerzenia z zieloną strzałką w dół są niewymagane a te z wykrzyknikiem w żółtym trojkącie są wymagane
    - - ciąg bitów zawierający zawartość podpisu cyfrowego (odcsk palca)
- - - - The private key that is associated with the certificate is compromised and is in the possession of an unauthorized individual—for example, if a portable computer is stolen or a smart card is lost.
    - - CACompromise. The smart card or disk on which the CA's private key is stored is compromised and is in the possession of an unauthorized individual. When a certificate manager revokes a CA's certificate, all certificates issued by that CA are considered revoked.
    - - An individual is terminated or has resigned from an organization. It is not necessary to revoke a certificate when an individual changes departments unless your security policy requires that each departmental CA should issue certificates to the individuals in that department.
    - - A new certificate must be issued if a smart card fails or the legal name of a user has changed. The new certificate supersedes the previous certificate, which must be revoked.
    - - If your organization decommissions a CA, use this revocation code to revoke the CA's certificate. Do not revoke the certificate if the CA publishes CRLs for the currently issued certificates but does not issue new certificates.
    - - CertificateHold. A temporary revocation that indicates that a CA will not vouch for a certificate at a specific time. After a certificate is revoked by using CertificateHold, you can later unrevoke the certificate
    - - If you revoke a certificate by using CertificateHold, you can unrevoke the certificate. The unrevoking process still lists the certificate in the CRL, but with the revocation code set to RemoveFromCRL. The RemoveFromCRL reason code is specific to the CertificateHold reason and is only used in delta CRLs.
    - - You can revoke a certificate without providing a specific revocation code. Using Unspecified is not recommended, however, because it does not provide an audit trail that identifies why a certificate was revoked.