Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual Download

Page: 28 / 564

Chapter 1. Overview of Red Hat Certificate System Subsystems

• A

certificate authority

called a

Certificate Manager

. The CA is the core of the PKI; it issues and

revokes all certificates. The Certificate Manager is also the core of the Certificate System. By
establishing a

security domain

of trusted subsystems, it establishes and manages relationships

between the other subsystems.

• A

key recovery authority

called a

data recovery manager

(DRM). Certificates are created based on

a specific and unique key pair. If a private key is ever lost, then the data which that key was used
to access (such as encrypted emails) is also lost because it is inaccessible. The DRM stores key
pairs, so that a new, identical certificate can be generated based on recovered keys, and all of the
encrypted data can be accessed even after a private key is lost or damaged.

• An

online certificate status responder

(OCSP). The OCSP verifies whether a certificate is valid and

not revoked. This function can also be done by the CA, which has an internal OCSP service, but
using an external OCSP eases the load off of the issuing CA.

• A

registration authority

(RA). An RA accepts certificate requests and verifies, independently,

whether that request should be approved. It then forwards approved requests to the CA to issue the
certificate. Like the OCSP, this is a function that can be performed by the CA, but using a separate
subsystem reduces the load on the CA.

• A

token key service

(TKS). The TKS derives keys based on the token CCID, private information,

and a defined algorithm. These derived keys are used by the TPS to format tokens and enroll, or
process, certificates on the token.

• A

token processing system

(TPS). The TPS interacts directly with external tokens, like smart

cards, and manages the keys and certificates on those tokens through a local client, the Enterprise
Security Client. The Enterprise Security Client contacts the TPS when there is a token operation,
and the TPS interacts with the CA, DRM, or TKS, as required, then send the information back to the
token by way of the Enterprise Security Client.

1.2.1. Certificate Manager

The Certificate Manager subsystem is a certificate authority. It issues, renews, revokes, and publishes
a wide variety of certificates: for servers, for users, for routers, for other subsystems, and for file or
object signing. The Certificate Manager also compiles and publishes CRLs.

Certificate Managers can be structured in series (

hierarchy

), so that one Certificate Manager sets

policies and issues signing certificates to a

subordinate CA

. The highest Certificate Manager in the

chain is a

root CA

A special kind of certificate is used by CAs to sign certificates they issue, sort of like a stamp or seal.
This is called a

CA signing certificate

. A subordinate CA is issued a CA signing certificate by a CA

higher in the hierarchy, and the parameters of the CA signing certificate are set by the superior CA. A
CA which issues its own signing certificate has a

self-signed certificate

. There are benefits to having a

self-signed CA certificate for your root CA, as well as some benefits to having the certificate signed by
a third-party CA.

Additionally, a Certificate Manager is always the subsystem which works as the

registry

for the security

domain. The very first Certificate Manager configured must create a security domain, but every
Certificate Manager configured after has the option of joining an existing security domain rather than
creating a new one. The configuration of your PKI deployment determines whether you need multiple
security domains; for more information, see the

Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Admin Manual

Search results

Summary of Contents for CERTIFICATE SYSTEM 8.0 - ADMINISTRATION

Reviews:

Related manuals for CERTIFICATE SYSTEM 8.0 - ADMINISTRATION

Brands by name

Popular brands