Had you and welcome back?
Now in today's video, we will be discussing about the Adobe Certificate manager now when it comes to
it should be, as we say, it's led to look into a traditional way in which the certificates will provision.
So let's say that you have your own website and you want the website to be available via a CTP is going
to choose only.
Now there are two ways to handle this.
Firstly, you can either create your own selfsame certificate, so the websites which have a self-signed
certificate or even the expected certificate.
Then when you open your browser, you will see this kind of a warning stating that this certificate
is not really trusted.
And second one is you can issue your certificate through a trusted certificate authority.
And in such cases, the browsers will go ahead and trust that a CTP is connections.
So selfsame certificate is like creating your own passport.
You are certifying authority did.
So no one will really trust it.
So if you want things to be trusted, then you'll have to go to a trusted authority like the designated
CS.
Now, before we proceed further, let me to tell you both of these examples that we were discussing.
Now from the browser, let me go ahead and open up a website where the certificate is not really issued
so that domain is safe.
Haven S. Dodecyl water dot com.
So the word dot com was my personal domain where I used to have my own blog.
However, due to time constraints, it was later removed.
So if you see audio, you're basically getting this not secure message stating that their connection
is not private and you can go ahead and decide to proceed.
Yet if you proceed.
You will be basically presented with a website, but clearly it is stating that disconnection is not
secure or, to be more precise, the certificate through which this connection was presented.
That certificate is not really for this specific domain.
Now, if you look into this certificate here, you will see this certificate was issued to a domain
Collins, ACM or Zilber or dot com, and this certificate is used your forces signed or deliverer dot
com.
Since it is not associated with this domain, you're basically getting this not secure message.
Now let's go ahead and open up the ACM Awards deal with our Dot Com Reader Certificate was actually
issued.
So I'll see ACM Awards Illawarra dot com with CTP is here.
And you see, you don't really get a warning like this now, if you'll quickly look into the certificate
here, it states connection is secure and the certificate is valid.
Now if we look into this certificate, this certificate was issued to ACM, not Silver Dot Com, and
the issuer was Amazon, and this certificate also has a specific validity audio.
Great.
So these are the two approaches which you'll generally see for certificates.
Now, let's quickly look into how you can generate a certificate, which is generally trusted by a browser.
So in order for the certificate to be trusted by a browser, you will have to go to a certificate authority.
That again, is trusted by the browser.
So let's say that you have a certificate authority and the browser trust those certificates that are
being issued by this year.
So what you'll have to do as a user, you'll have to ask the certificate authority to generate a certificate
for your domain.
So in this case, the certificate for their domain escapee labs got in.
And definitely, you'll also have to also make payment and complete the relevant formalities.
After you have completed the formalities, then the certificate authority will issue you the certificate
with a specific validity.
So in this case, the validity is one year.
And what does see is giving you two years giving you the certificate as well as the private key.
So both of these you will be adding a part of your configuration.
Generally, the website reconfiguration and then you'll typically have a IDPs based website that is
trusted.
Now at this stage, this is fine.
However, one of the challenges that doing journalism organizations is that they forget to renew their
certificates.
So this certificate that was issued by CAA was only valid for one year, and the website is working
completely fine.
Every browser is trusting noise issues.
But after one year, the administrator actually forgot to renew their certificate, and immediately
after the certificate gets expired, the website will have this kind of a warning, and generally this
will block the production traffic.
I still remember in one of the organization that I was working with.
In fact, I had recently joined.
It was my second or the third day and there was only two people in the team.
So instead, bebop security was only two people.
One was my manager and second was me.
So what happened was that the main certificate of the primary domain expired and the entire mobile application
to which most of the orders came as part of the Business Day bad mobile app was not working in terms
of port easing or making the order payments.
And it was a big issue during that time.
So this was one of the learnings where you always have to verify the expiry and also have to set the
right kind of alarms.
So generally, what happens is that before the Expiry Certificate Authority will generally send you
email stating that your certificate is bound to expire in one month, bound to expire in 15 days, 20
days, etcetera.
However, the issue with that organization was the email that was configured was of a different person
who had left the organization, so they forgot to update their email address to that of the newer team.
And that was one of the reasons why they were not able to quickly identify that the certificate is expiring
and the in and went through.
So this is one of the important learning that you also have to take care of.
So nowadays is generally for the organizations who are typically based on E.W. as extensively.
There is a new better to be on which the certificates are issued and provision, which is through the
certificate manager.
So the Edgbla Certificate Manager, also referred to as the ECM, basically allows you to create these
certificates, which you can use in your websites and applications.
So instead of going directly to a specific certificate authority through the ACM, you can tell ACM
to generate a certificate of your domain with escapee labs.
Not in the scheme will generate the certificate, as well as the private keys, so both of these things
will be generated for you.
However, these things will not be given to you, and this is quite good in one sense.
So then once the certificate private keys and treated, then you can see that integrate this certificate
with the aid of this service to which the traffic is coming from in this case, load balancer.
So ACM will be integrated with the load balancer.
So you will have a setpiece website where you are.
So this is a great way of issuing the certificates specifically if you are based on E.W..
Now let me also quickly show you this.
So currently within the certificate manager console and you see that there is one certificate that is
issued, that type is Amazon issued.
And the domain name is ACM, not Zalora dot com.
And it is also eligible for a new ability, so we do not really need to worry on that part.
Now, if we look into the certificate details, it basically gives you the details associated with it.
And it also shows you the associated resource.
So in this case, the associated resource is an elastic load balancer, so the ACM certificate is integrated
with the load balancer.
Now, if you look into the load balancer here, all the traffic comes to the load balancer.
If you're looking to the listeners, you have a city based listener offered for three.
And you can also click on View a certificate.
So you have a ACM certificate that is associated with this specific load balancer.
And things become very simple when you integrate is the image load balancers.
Now let me also tell you one more advantage very if certificate in private key and not given to you
why it is much motivated.
So generally, what happens is that a lot of organizations, when they receive certificate in private
key from the certificate authority, they do not really secure it.
And then what really happens is that encrypted traffic in case of the certificate and a private key
gets leaked and there is an encrypted traffic communication or you have a traffic packet, then you
can actually be carrying those packets.
So the security of the certificate and private keys is very, very important.
And from what I have seen most of the organization, they do not really secure this.
You will see that certificate of private key essentially added as part of the GitHub repository or whatever
private repository that the organization has.
And if a team member has access to it and he leaves the organization tomorrow, he takes away the certificate
as well as the private key to later.
Maybe he will be able to decrypt the communication if he has the encrypted traffic packets.
So this is not the best way to deal with it in case of ACM, since you are not really given both the
certificate as well as the private key eatables takes scared of it.
You do not really need to worry about it at all.
So this is a very high level overview about the certificate manager.
And with this will conclude today's video.