Configuring Pki; Overview; Pki Terminology - HP 5920 Series Configuration Manual

Configuring PKI

Overview

Public Key Infrastructure (PKI) is an asymmetric key infrastructure to encrypt and decrypt data for securing
network services. Data encrypted with the public key can be decrypted only with the private key. Likewise,
data encrypted with the private key can be decrypted only with the public key.
PKI uses digital certificates to distribute and employ public keys, and provides network communication
and e-commerce with security services such as user authentication, data confidentiality, and data
integrity.
HP's PKI system provides certificate management for IPsec and SSL.

PKI terminology

Digital certificate
A digital certificate is a document signed by a certificate authority (CA). It includes the issuer name (the
name of the CA), the subject name (name of the individual or group to which the certificate is issued), the
identity information of the subject, the subject's public key, the signature by the CA, and the period of
validity. The CA's signature ensures the validity and authority of the certificate. A digital certificate binds
a public key to its owner.
A digital certificate must comply with the international standards of ITU-T X.509, of which X.509 v3 is
common.
This chapter covers the following types of certificates:
CA certificate—Certificate of a CA. Multiple CAs in a PKI system form a CA tree with the root CA
•
at the top level. The root CA issues a CA certificate for itself, and each lower level CA holds a CA
certificate issued by the CA one level above it. The certificate of the root CA, the certificates of
intermediate CAs, and the end certificate build a certificate chain. The certificate chain establishes
a chain of trust.
Registration authority (RA) certificate—Certificate issued by a CA for an RA. RAs are trusted by
•
CAs to accept requests for enrollment in a PKI system, and they are optional in a PKI system.
Local certificate—Digital certificate issued by a CA for the local entity.
•
• Peer certificate—Digital certificate issued by a CA for a peer entity.
Certificate revocation list
A certificate revocation list (CRL) is a list of revoked certificates, and is created and signed by a given CA.
A certificate must be revoked when, for example, the username changes, the private key is compromised,
or the user is no longer certified by the CA. The CA periodically publishes a CRL that contains the serial
numbers of all revoked certificates. CRLs provide an effective way for verifying the validity of certificates.
CA policy
A CA policy is a set of criteria that a CA follows in processing certificate requests, issuing and revoking
certificates, and publishing CRLs. Usually, a CA advertises its policy in a certification practice statement
(CPS). You can obtain a CA policy through out-of-band means such as phone, disk, and email. Make
118