Certificates and Certificate Chains
This section describes what is a certificate and what is a certificate path. A certificate is a digitally signed statement from the issuer saying that the public key of the subject has some specific value.
Certificate: A digitally signed statement from the issuer saying
that the public key of the subject has some specific value.
The above definition is copied from the JDK documentation. It has
a couple of important terms:
- "signed statement" - The certificate must be signed by the issuer with
a digital signature.
- "issuer" - The person or organization who is issuing this certificate.
- "public key" - The public key of a key pair selected by the subject.
- "subject" - The person or organization who owns the public key.
X.509 Certificate - A certificate written in X.509 standard format.
X.509 standard was introduction in 1988. It requires a certificate to have
the following information:
- Version - X.509 standard version number.
- Serial Number - A sequence number given to each certificate.
- Signature Algorithm Identifier - Name of the algorithm used
to sign this certificate by the issuer
- Issuer Name - Name of the issuer.
- Validity Period - Period during which this certificate is valid.
- Subject Name - Name of the owner of the public key.
- Subject Public Key Information - The public key and its related information.
How can you get a certificate for your own public key?
- Requesting it from a Certificate Authority (CA), like VeriSign, Thawte or Entrust.
- Doing it yourself - using tools like JDK "keytool" to generate a self-signed certificate.
Certificate Chain: A series of certificates that one certificate signs the
public key of the issuer of the next certificate. Usually the top certificate
(the first certificate) is self-signed, where issuer signed its own public key.
Table of Contents
About This Book
Cryptography Basic Concepts
Introduction to AES (Advanced Encryption Standard)
Introduction to DES Algorithm
DES Algorithm - Illustrated with Java Programs
DES Algorithm Java Implementation
DES Algorithm - Java Implementation in JDK JCE
DES Encryption Operation Modes
DES in Stream Cipher Modes
PHP Implementation of DES - mcrypt
Blowfish - 8-Byte Block Cipher
Secret Key Generation and Management
Cipher - Secret Key Encryption and Decryption
Introduction of RSA Algorithm
RSA Implementation using java.math.BigInteger Class
Introduction of DSA (Digital Signature Algorithm)
Java Default Implementation of DSA
Private key and Public Key Pair Generation
PKCS#8/X.509 Private/Public Encoding Standards
Cipher - Public Key Encryption and Decryption
MD5 Mesasge Digest Algorithm
SHA1 Mesasge Digest Algorithm
OpenSSL Introduction and Installation
OpenSSL Generating and Managing RSA Keys
OpenSSL Managing Certificates
OpenSSL Generating and Signing CSR
OpenSSL Validating Certificate Path
►"keytool" and "keystore" from JDK
►Certificates and Certificate Chains
What Is "keystore"?
"keytool" - Command Line Tool
Generating Private Keys
Exporting and Import Certificates
Generating CSR (Certificate Signing Request)
Cloning Certificates with New Identities
"OpenSSL" Signing CSR Generated by "keytool"
Migrating Keys from "keystore" to "OpenSSL" Key Files
Certificate X.509 Standard and DER/PEM Formats
Migrating Keys from "OpenSSL" Key Files to "keystore"
Using Certificates in IE
Using Certificates in Google Chrome
Using Certificates in Firefox
Full Version in PDF/EPUB