Understand the PKI Environment.
Let's start with an official definition. Certificate authorities are
trusted third parties that help establish and maintain the integrity
of a PKI system. CAs issue public key certificates and verify that
individuals applying for the digital keys are who they claim to be,
and this can be users, devices, services,
network paths,
you name it. You can almost certify anything in a technical environment.
And also, the information provided has not been altered in
any way since it was signed digitally.
Public key encryption includes a private key and a public key.
Just as it's described,
your private key is very important because you do not want this compromised.
The public key, anybody can have that.
It's pretty much advertised out there.
You like giving this out.
Here's the catch.
You need both keys to unlock the door, as it were. To encrypt and
decrypt, you need both keys working together.
The beauty of all this is you never have to share the key that unlocks the
door, you just share half of the key set that unlocks the door.
Now, there's two major types of encryption here,
the digital signature, and this ensures that the message has not been altered
and gives you assurance of the sender's identity because it has been
identified by the CA, then you have digital encryption.
This ensures that the message has not been seen by anyone else, there is no
man‑in‑the‑middle attack here, and also that the message can only be read by
you, the recipient, or whoever you're sending the message to, all done through
the key pair, private key and public key.
Let's go over the process.
You have an entity. This entity could be a computer,
a device, a server, a network path, a person,
a website, an application, all of those pretty much operate the same.
They submit a request.
The request, depending upon the certificate authority, is going to
have certain information that identifies them.
They submit this request and then the certification authority
takes a look at it and considers the request.
Two major things that this CA is going to look at.
Did they ID themselves and do they have permission to get the certificate?
Now, when you're dealing with public CAs, it's pretty much did
they include a check or a credit card number? That's your
permission, but they still identify you.
If everything seems to work out, then they add the entity to the
record and issue a certificate to that entity.
And this certificate is going to have two major things on
it, the public key and the CA signature.
They're going to also give you a private key that is stored in a safe location.
So, the public key is made public, the private key, of course, remains private.
Now, when you're trying to communicate with somebody else or let them
know who you say you are through a digital signature,
you simply send them the certificate.
Now they have your public key, and if they trust that CA, you're
in business. Everything can work with that.
That trust is important,
and it's something that we'll emphasize in this course. And that is the
basics on the whole PKI infrastructure that was invented and helps us
secure communications and prove identities.
Up next,
we're going to take a look at the particular implementation of PKI with the Microsoft Server 2022 Active directory certificate services.