An Overview Of Certificates And Security - Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Manual

160
Package Name
openssl-devel
stunnel

15.3 An Overview of Certificates and Security

Your secure Web server provides security using a combination of the Secure Sockets Layer (SSL)
protocol and (in most cases) a digital certificate from a Certificate Authority (CA). SSL handles the
encrypted communications and the mutual authentication between browsers and your secure Web
server. The CA-approved digital certificate provides authentication for your secure Web server (the
CA puts its reputation behind its certification of your organization's identity). When your browser is
communicating using SSL encryption, you will see the https:// prefix at the beginning of the Uniform
Resource Locator (URL) in the navigation bar.
Encryption depends upon the use of keys (think of them as secret encoder/decoder rings in data for-
mat). In conventional or symmetric cryptography, both ends of the transaction have the same key,
which they use to decode each other's transmissions. In public or asymmetric cryptography, two keys
co-exist: a public key and a private key. A person or an organization keeps their private key a secret,
and publishes their public key. Data encoded with the public key can only be decoded with the private
key; data encoded with the private key can only be decoded with the public key.
To set up your secure server, you will use public cryptography to create a public and private key pair. In
most cases, you will send your certificate request (including your public key), proof of your company's
identity, and payment to a CA. The CA will verify the certificate request and your identity, and then
send back a certificate for your secure Web server.
A secure server uses a certificate to identify itself to Web browsers. You can generate your own certifi-
cate (called a "self-signed" certificate) or you can get a certificate from a Certificate Authority or CA.
A certificate from a reputable CA guarantees that a website is associated with a particular company
or organization.
Alternatively, you can create your own self-signed certificate. Note, however, that self-signed cer-
tificates should not be used in most production environments. Self-signed certificates will not be
automatically accepted by a user's browser — the user will be asked by the browser if they want to
accept the certificate and create the secure connection. See Section 15.5, Types of Certificates for
more information on the differences between self-signed and CA-signed certificates.
Once you have a self-signed certificate or a signed certificate from the CA of your choice, you will
need to install it on your secure Web server.
Chapter 15:Apache Secure Server Configuration
Located in Group
Development/Libraries
Applications/Internet
Optional?
yes
yes