Certificates; Overview - D-Link DFL-1660 User Manual

3.8. Certificates

3.8. Certificates

3.8.1. Overview

The X.509 Standard
NetDefendOS supports digital certificates that comply with the ITU-T X.509 standard. This
involves the use of an X.509 certificate hierarchy with public-key cryptography to accomplish key
distribution and entity authentication. References in this document to certificates mean X.509
certificates.
When distributed to another party, a certificate performs two functions:
• It distributes the certificate owner's public key.
• It establishes the certificate owner's identity.
A certificate acts as a digital proof of identity. It links an identity to a public key in order to establish
whether a public key truly belongs to the supposed owner. By doing this, it prevents data transfer
interception by a malicious third-party who might post a fake key with the name and user ID of an
intended recipient.
Certificates with VPN Tunnels
The main usage of certificates in NetDefendOS is with VPN tunnels. The simplest and fastest way
to provide security between the ends of a tunnel is to use Pre-shared Keys (PSKs). As a VPN
network grows so does the complexity of using PSKs. Certificates provide a means to better manage
security in much larger networks.
Certificate Components
A certificate consists of the following:
• A public key.
• The "identity" of the user, such as name and user ID.
• Digital signatures that verify that the information enclosed in the certificate has been verified by
a CA.
By binding the above information together, a certificate is a public key with identification attached,
coupled with a stamp of approval by a trusted party.
Certificate Authorities
A certificate authority (CA) is a trusted entity that issues certificates to other entities. The CA
digitally signs all certificates it issues. A valid CA signature in a certificate verifies the identity of
the certificate holder, and guarantees that the certificate has not been tampered with by any third
party.
A CA is responsible for making sure that the information in every certificate it issues is correct. It
also has to make sure that the identity of the certificate matches the identity of the certificate holder.
Certificate Chains
150
Chapter 3. Fundamentals