X.509 Certificates; Introduction To Certificates - D-Link DFL-1600 User Manual

8.4. X.509 Certificates
8.4 X.509 Certificates
D-Link firewalls support certificates that comply with the ITU-T X.509
international standard. This technology use an X.509 certificate hierarchy
with public-key cryptography (See 20.2,
accomplish key distribution and entities authentication.
8.4.1 Introduction to Certificates
A certificate is a digital proof of identity. It links an identity to a public key
for establishing whether a public key truly belongs to the supposed owner.
Thus, it prevents data transfer interception by any ill-intending third-party,
who may post a phony key with the name and user ID of an intended
recipient. A certificate consists of the following:
- A public key: The "identity" of the user, such as name, user ID, etc.
- Digital signatures: A statement that tells the information enclosed in
the certificate has been vouched for by a Certificate Authority (CA).
Binding the above information together, a certificate is a public key with
identification forms attached, coupled with a stamp of approval by a
trusted party.
Certification Authority
A certification authority (CA) is a trusted entity that issues certificates to
other entities. The CA digitally signs all certificates it issues. A valid CA
signature in a certificate verifies the identity of the certificate holder, and
guarantees that the certificate has not been tampered with by any third
party.
A certification authority is responsible for making sure that the information
in every certificate it issues is correct. It also has to make sure that the
identity of the certificate matches the identity of the certificate holder.
A CA can also issue certificates to other CAs. This leads to a tree-like
certificate hierarchy. The highest CA is called the root CA. In this
hierarchy, each CA is signed by the CA directly above it, except for the
root CA, which is typically signed by itself.
A certification path refers to the path of certificates from one certificate to
another. When verifying the validity of a user certificate, the entire path
Introduction to
D-Link Firewalls User's Guide
49
Cryptography) to