Web Security and Commerce

Certification Authority Certificates

A certification authority certificate is a certificate that contains the name and public key of a certification authority. These certificates can be self-signed: the certification authority tells you that its own key is good, and you trust it. Alternatively, these certificates can be signed by another entity. CAs can also cross-certify , or sign each other’s master keys. What such cross-certification actually means is an open question.

CA certificates are normally distributed by trusted means, such as being embedded directly in web browsers.

Bootstrapping the PKI

When Netscape Communications Corporation released the first beta version of its Netscape Navigator, it was faced with a problem. Navigator’s SSL protocol required the existence of a certification authority to make it work, but there were no CAs that were offering service to the general public.

Rather than set up its own CA, which could have been seen by some companies as anticompetitive, Netscape turned to RSA Data Security, which had supplied the public key technology software on which Navigator was based. For several years RSA had been running its own CA called RSA Certification Services. This CA’s primary reason for existence was to enable protocols that require CAs, such as Privacy Enhanced Mail (PEM). RSA was more than happy to issue certificates for Netscape servers as well.

In 1995, RSA spun out its certificate services division to a new company called VeriSign. Since then, each ...