In this video from ITFreeTraining I will look at what is a certificate. Certificates are
used for security and identification, but how do they work? This video looks at what
is a certificate and how they are used to secure communication and prove identity.
First of all what is a certificate? A certificate is simply a file or an electronic document
that contains data fields. If I were to compare a digital certificate
with a traditional physical certificate you will notice some similarities. As shown in
the traditional certificate, you can see who has issued the certificate, in this case ITFreeTraining.
If you had a certificate from an organization like a University the certificate would have
this printed on it so you know who issued it.
An electronic certificate is issued from an Authority as well. By looking at the data
inside the certificate it can easily be determined which Authority it was issued from. The next
question is would you trust this authority. By doing a quick search on the internet, you
will find many web sites that will take your money and give you a certificate showing you
have a PHD. An employer should not trust these certificates. If an employer was given a certificate
that came from an educational institution like Harvard University, they would have good
reason to trust this certificate. This is because in order for a person to obtain a
certificate from Harvard University they would have need to complete all the necessary steps
in order to achieve this. Electronic certificates work off the same
principal of trust. Do you trust the person that issued the digital certificate like you
would a physical certificate? If a certificate said that it was issued by Microsoft would
you trust this certificate? If a certificate came from a web site you had never heard of
before, would you be so quick to trust it? As we will see later in the video, certificates
use a trust model in order for the end user to know where the certificate has come from
and whether it is genuine or not. The next point of interest is whom the certificate
was issued to. The certificate shown here was issued to John Doe. Like a physical certificate,
an electronic certificate is issued to someone or something. For example, an electronic certificate
could be issued to a user, computer, device or webpage. By using this information, the
electronic certificate can be checked to see if the user, computer, device or web page
should be using that certificate. Just like a physical certificate, the name on the certificate
can be checked to make sure that the person using it is the same person. If the name does
not match, this means that someone is using a certificate they are not supposed to be
and thus the certificate is rejected. Some physical certificates have expiry dates.
For example, certain IT Certifications will expire after a certain date unless you pass
additional exams. In this case, the example physical certificate has an expiry date. Electronic
certificates also have an expiry date associated with them. Once this date is reached the certificate
can no longer be used. A common piece of data contained in an electronic
certificate that is not contained in a physical certificate is the public key. The public
key allows data to be encrypted that can only be decrypted using the private key. For example,
if you had a certificate from Microsoft.com, you could use this certificate to encrypt
data so that only people at Microsoft could decrypt it.
The next part of the electronic certificate is the digital signature. This is like the
wax seal on a physical certificate. Just like the wax seal, the digital signature proves
the certificate came from a trusted source and is not a fake. The digital signature also
provides an additional feature in that it provides a checksum like function to the digital
certificate. That is, it can be used to check if the certificate has been altered.
This is only some of the data that is contained in a certificate. Other data also exists like
the algorithms and key sizes used. To understand how certificates work, it helps to have a
closer look at the digital signature in the certificate.
The first point to understand with a digital signature is the hash value. The hash value
is a value that represents the certificate. The hash is calculated by putting the certificate
through a mathematical function to produce a value. A simple hash function would be to
add each byte in a file together to obtain a single number, of course the hash function
used in certificates is more complex than this.
The hash value is then put through a mathematical function using the private key to generate
a digital signature. This digital signature is then added to the certificate. Now that
the digital signature has been added to the certificate, it can be used later to check
that the certificate has not been altered or damaged.
To check the certificate, the digital signature is put through a mathematical function using
the public key. The result of this should be the original hash value. If this value
is not obtained, the person knows the certificate is corrupt or has been tampered with.
The hash function is a one way process which means you cannot use the hash value to generate
the original certificate. This essentially means that even though the private key is
used in the process, it is not possible to use the digital signature to obtain the private
key. So what exactly does the digital signature
do? First, it provides a method for checking the identity, for example if you had a certificate
that was issued to ITFreeTraining.com, the name of the web site could be included as
a field in a certificate. When the certificate is downloaded to a client computer, the client
computer checks the name on the certificate to see if it matches the website that they
are trying to access. If it does the certificate will be used.
You can see that if another web site also obtained this certificate and attempted to use
it, the certificate would be rejected as the name in the certificate and web site do not
match. Remember that a certificate is essentially
a file with data in it, so it is an easy process to change the name in the certificate. If
this were to occur and an attempt was made to use the certificate, the digital signature
would come in to play. Notice that when a modified certificate is used the digital signature
will not match the data in the certificate and the certificate will be rejected. This
is how a certificate can be used to prove identity and how they protect themselves from
being tampered with. The next question that arises is, if you were given a digital certificate,
would you trust this certificate? Certificates work off a trust model. To illustrate
this, consider an example that occurs often in the real world. In this example, let's
say you have the company Microsoft. Microsoft makes operating systems as we know and you
want to buy a laptop that will work with Windows 8.
In order to do this, you find a laptop and see that the laptop has a sticker on it saying
Windows 8 Compatible. Even though the laptop is not made by Microsoft, you can be assured
that because it has this sticker, Windows 8 will work on this laptop.
So what has happened here. You are trusting that the manufacturer of the laptop has put
the sticker on the laptop because their laptop works with Windows 8. You are trusting Microsoft
that they would not allow a sticker like this to be put on a laptop that would not run Windows
8. Thus you can see how one trusts the other and the person who purchases the laptop must
trust both. So how does this all relate to certificates?
Certificates use the same type of trust model. At the top you have a certificate authority.
In this example I will use the Certificate Authority VeriSign. VeriSign has been around
for a long time and is well trusted on the internet.
A Certificate Authority's job is to issue certificates. These certificates could be
used for users, computers, devices and web pages. Let's say ITFreeTraining wants to
get a certificate for their web page. To do this they obtain a certificate from VeriSign
which would allow a visitor to the ITFreeTraining web site to use encryption like SSL.
Before VeriSign would issue a certificate to ITFreeTraining a number of checks are performed.
These checks include checking who registered the domain name and a number of checks on
the business. This helps prevent certificates being issued to individuals who want to use
the certificates for illegal activities. For example, if someone attempted to obtain a
certificate for M1crosoft.com, notice that the i has been changed to 1, this would be
denied. What this essentially means is that if you
use a certificate from VeriSign, you can be assured that a number of checks have been
performed before the certificate was issued. It is possible for a certificate to be issued
to a company that is doing the wrong thing, but at least you can be assured that some
checks have been performed to determine that they are at valid company.
The next question is, what happens when a user connects to the ITFreeTraining web site
and obtains the certificate? How does it know it is valid and from VeriSign and why would
it trust and thus use this certificate? By default, a number of certificates are installed
on the client computer when the operating system is installed. These include a VeriSign
certificate. Since the certificate is installed locally
in the OS, the OS will trust any certificates issued from VeriSign. When the certificate
is downloaded from ITFreeTraining, the digital signature is used in the certificate to determine
a number of different things. First that the certificate has not been tampered with
and the website matches the website in the certificate.
Using the local certificate installed in the OS, Windows can check the certificate obtained
from ITFreeTraining to see if it is in fact a VeriSign certificate. You can start to see
how the certificate trust model works. The computer must trust the Certificate Authority that
the certificate came from just like you would trust an organization like Harvard University.
If you were given a certificate with the Harvard University logo on it, would you trust it?
Also consider that if you were an employer that had never heard of Harvard University,
would you trust a certificate from an educational institution that you had not heard of before?
Certificates work the same way, you need to trust who issued the certificate in order
to start using it. When you are surfing on the internet, you
may be presented with the following screen. This is essentially telling you that you visited
a website that Windows does not trust. This essentially means no certificate is installed
locally on the computer or the site has not been placed in an exception list.
What this essentially means from a user's prospective is that Windows has not been configured
to trust certificates from this source. In this case, the user can take the risk and
accept the certificate and hope for the best or not to open the web site.
All though certificate authorities like VerSign are trusted by Windows by default, you may
want to use your own Certificate Authority. Besides having complete control over the certificate
Authority, certificates from companies like VerSign do cost money. If you have your own
certificate Authority you can issue as many certificates as you wish at no cost besides
the costs for the operating system and hardware to run it on.
When deploying a certificate infrastructure this will often be done at a number of different
levels. At the top you will have the root CA. The root CA will issue certificates to
subordinate or 2nd level certificate authorities. Often what will happen after the root CA has
issued certificates to the second level authorities, the root CA will be taken offline. Since the
root CA holds the private key that effectively is the key to the entire certificate infrastructure,
this should be protected. In some cases, a company will install the root CA on removable
media. Once the root CA is not needed any more, the removable media is placed in a safe
until it is needed again. The second level CA's are free to issue certificates without
the root CA, so the system will work fine even though the root CA is offline. Having
the root CA offline helps keep it secure. The 2nd level CA will often issue certificates
to users and computers. For example, a certificate may be issued to a user so their identity
can be checked when using a VPN connection. It is also possible to have additional levels
of Certificate Authorities if your organization requires it.
In this example, let us consider what happens when a computer attempts to connect to a web
server. The certificate for that web site will be downloaded to the client, but will
the client trust that certificate? In order for the certificate to automatically
be trusted, a certificate from the root CA needs to installed locally on the client computer.
Once this certificate is installed on the computer, the computer will trust any certificate
automatically that comes from any certificate authority in this hierarchy. It is kind of
like the old saying, any friend of yours is a friend of mine. If the root CA is trusted
by the client, any of the child CA's will be trusted automatically.
I hope this video has given you a good understanding of how certificates can check identity, check
for corruption and modification, and lastly how they work with a trust model. Thanks for
watching this video from ITFreeTraining. See you next time.