Managing Certificates
796
Red Hat Certificate System Administrator’s Guide • September 2005
Certificates and the LDAP Directory
The Lightweight Directory Access Protocol (LDAP) for accessing directory services
supports great flexibility in the management of certificates within an organization. System
administrators can store much of the information required to manage certificates in an
LDAP-compliant directory. For example, a CA can use information in a directory to
prepopulate a certificate with a new employee’s legal name and other information. The CA
can leverage directory information in other ways to issue certificates one at a time or in
bulk, using a range of different identification techniques depending on the security policies
of a given organization. Other routine management tasks, such as key management and
renewing and revoking certificates, can be partially or fully automated with the aid of the
directory.
Information stored in the directory can also be used with certificates to control access to
various network resources by different users or groups. Issuing certificates and other
certificate management tasks can thus be an integral part of user and group management.
In general, high-performance directory services are an essential ingredient of any certificate
management strategy. Red Hat Directory Server is fully integrated with Red Hat Certificate
System to provide a comprehensive certificate management solution.
Key Management
Before a certificate can be issued, the public key it contains and the corresponding private
key must be generated. Sometimes it may be useful to issue a single person one certificate
and key pair for signing operations, and another certificate and key pair for encryption
operations. Separate signing and encryption certificates make it possible to keep the private
signing key on the local machine only, thus providing maximum nonrepudiation, and to
back up the private encryption key in some central location where it can be retrieved in case
the user loses the original key or leaves the company.
Keys can be generated by client software or generated centrally by the CA and distributed
to users via an LDAP directory. There are trade-offs involved in choosing between local
and centralized key generation. For example, local key generation provides maximum
nonrepudiation, but may involve more participation by the user in the issuing process.
Flexible key management capabilities are essential for most organizations.
Key recovery,
or the ability to retrieve backups of encryption keys under carefully defined
conditions, can be a crucial part of certificate management (depending on how an
organization uses certificates). Key recovery schemes usually involve an
m of n
mechanism:
for example,
m
of
n
managers within an organization might have to agree, and each
contribute a special code or key of their own, before a particular person’s encryption key
can be recovered. This kind of mechanism ensures that several authorized personnel must
agree before an encryption key can be recovered.
Summary of Contents for CERTIFICATE 7.1 ADMINISTRATOR
Page 1: ...Administrator s Guide Red Hat Certificate System Version7 1 September 2005 ...
Page 22: ...22 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 128: ...Cloning a CA 128 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 368: ...ACL Reference 368 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 460: ...Constraints Reference 460 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 592: ...CRL Extension Reference 592 Red Hat Certificate System Administrator s Guide September 2005 ...
