How Certificates Are Used - Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual

Certificates and Authentication
As you can see by comparing Figure J-5 to Figure J-4, certificates replace the authentication
portion of the interaction between the client and the server. Instead of requiring a user to
send passwords across the network throughout the day, single sign-on requires the user to
enter the private-key database password just once, without sending it across the network.
For the rest of the session, the client presents the user's certificate to authenticate the user to
each new server it encounters. Existing authorization mechanisms based on the
authenticated user identity are not affected.

How Certificates Are Used

• Types of Certificates
• SSL Protocol
• Signed and Encrypted Email
• Form Signing
• Single Sign-On
• Object Signing
Types of Certificates
Five kinds of certificates are commonly used with Red Hat products:
• Client SSL certificates. Used to identify clients to servers via SSL (client
authentication). Typically, the identity of the client is assumed to be the same as the
identity of a human being, such as an employee in an enterprise. See "Certificate-Based
Authentication," which begins on page 778, for a description of the way client SSL
certificates are used for client authentication. Client SSL certificates can also be used
for form signing and as part of a single sign-on solution.
Examples: A bank gives a customer a client SSL certificate that allows the bank's
servers to identify that customer and authorize access to the customer's accounts. A
company might give a new employee a client SSL certificate that allows the company's
servers to identify that employee and authorize access to the company's servers.
• Server SSL certificates. Used to identify servers to clients via SSL (server
authentication). Server authentication may be used with or without client
authentication. Server authentication is a requirement for an encrypted SSL session.
For more information, see "SSL Protocol" on page
780 Red Hat Certificate System Administrator's Guide • September 2005
782."