About Secure Sockets Layer - Sun Microsystems GlassFish Enterprise Server 2.1 Administration Manual

Most importantly, a certificate binds the owner's public key to the owner's identity. Like a
passport binds a photograph to personal information about its holder, a certificate binds a
public key to information about its owner.
In addition to the public key, a certificate typically includes information such as:
The name of the holder and other identification, such as the URL of the Web server using
■
the certificate, or an individual's email address.
The name of the CA that issued the certificate.
■
An expiration date.
■
Digital Certificates are governed by the technical specifications of the X.509 format. To verify
the identity of a user in the certificate realm, the authentication service verifies an X.509
certificate, using the common name field of the X.509 certificate as the principal name.
About Certificate Chains
Web browsers are preconfigured with a set of root CA certificates that the browser
automatically trusts. Any certificates from elsewhere must come with a certificate chain to verify
their validity. A certificate chain is series of certificates issued by successive CA certificates,
eventually ending in a root CA certificate.
When a certificate is first generated, it is a self-signed certificate. A self-signed certificate is one
for which the issuer (signer) is the same as the subject (the entity whose public key is being
authenticated by the certificate). When the owner sends a certificate signing request (CSR) to a
CA, then imports the response, the self-signed certificate is replaced by a chain of certificates. At
the bottom of the chain is the certificate (reply) issued by the CA authenticating the subject's
public key. The next certificate in the chain is one that authenticates the CA's public key.
Usually, this is a self-signed certificate (that is, a certificate from the CA authenticating its own
public key) and the last certificate in the chain.
In other cases, the CA can return a chain of certificates. In this case, the bottom certificate in the
chain is the same (a certificate signed by the CA, authenticating the public key of the key entry),
but the second certificate in the chain is a certificate signed by a different CA, authenticating the
public key of the CA to which you sent the CSR. Then, the next certificate in the chain is a
certificate authenticating the second CA's key, and so on, until a self-signed root certificate is
reached. Each certificate in the chain (after the first) thus authenticates the public key of the
signer of the previous certificate in the chain.

About Secure Sockets Layer

Secure Sockets Layer (SSL) is the most popular standard for securing Internet communications
and transactions. Web applications use HTTPS (HTTP over SSL), which uses digital certificates
to ensure secure, confidential communications between server and clients. In an SSL
connection, both the client and the server encrypt data before sending it, then decrypt it upon
receipt.
Chapter 9 • Configuring Security
Introduction to Certificates and SSL
109