Securing Windows Server 2003

What Is a Certification Authority?

Public key certificates are the answer to many authentication issues, as you’ve just seen. The next question is: where does the server get its certificate? From a CA. This is the crux of what I’ll be discussing in this section. The web server certificate can come from either a public or private CA, but either way, a CA must provide that certificate by signing the requested certificate with its private key.

Certification authorities primarily provide three functions:

Issue public key certificates

The heart of any CA is the ability to receive a request from a client for a public key certificate and issue a certificate in response. This process can take many different forms and be governed by both technology-based and administration-based rules. The certificate requests are often governed by certificate templates, which define what information is required for a request and what type of certificate can be issued based on each request.

Publish certificate revocation lists

When certificates are compromised, there must be a way to notify clients that the certificate is invalid. The CA creates a list of invalid (or revoked) certificates and then distributes (publishes) the list. This list is called a certificate revocation list (CRL). It is similar to the old lists of lost or stolen credit cards that were distributed to merchants. A merchant who accepted a credit card would hopefully check the list to ensure the card number was not listed. Similarly, whenever ...