What is the lifecycle of a certificate how do we receive a certificate.
First we have to submit an appropriate request to the certification center that handles us the certification
authority should verify us how precise the verification will be depends on what type of certificate
we expect some certificates such as those that have a short period of validity and allow only EFH system
encryption or not especially sensitive that can be issued without the need to personally apply for them.
Other certificates for example a certificate enabling the recovery of encrypted files using FS by other
users are much more sensitive.
We should not issue it to someone who has not applied for it personally.
Then the certificate is delivered to the computer the user or the service.
We have seen that we have three certificates stores the service store is really user store for which
a given service operates
from this moment.
If the applications are compatible with the public key infrastructure such a certificate may be used
a good example is the browser we don't install anything on it we don't configure anything.
And it works
after some time the certificate expires or it's revoked.
Applications check before using the certificate if it's still valid.
If not they block the use of the certificate if the validity of the certificate has expired.
We can ask for its renewal if we still have the right to use a given certificate.
It will automatically be issued to us.
We mentioned that applications verify whether the certificate is valid.
What does this mean.
First the certificate is valid if it's been issued by a trusted certification authority either directly
or through a subordinate authority whom we trust.
Second we must check whether the certification authority is trusted meaning it's included in the hierarchy
of trust.
If there is no gap in the series of certificates.
Third the certificate itself must be correct.
Now let's look at the technical side.
What is the generated data look like which is later recorded in the certificate.
To start with submit a certificate request then we generate a key pair the private key and the public
key.
If the operating system generates two keys we use Microsoft's cryptographic service provider the private
key goes to the user's profile.
It saved and protected by the Data Protection API if were used external devices for example a smart
card that generates the private key and does not make it available to the outside it safely say is it
to ensure to the certification authority that it's really us who are in fact submitting a certificate
request we're digitally sign the certificate request then we send the request together with the public
key to the certification authority.
The certification authority should verify our request.
It can be processed automatically Microsoft Certification systems process many such requests automatically
if the user has the appropriate privileges in the domain such as the right to issue certificates he
automatically receives the certificate.
However sometimes a request must be approved manually the certificate manager will review the request
and will process it positively or negatively if positive certificate returns to us.
From now on we can use it.
How can we submit a request to issue a certificate.
This can be done in several ways by using the certificates so that we saw by clicking the right mouse
button on the personal store there will be an option submit new certificate request.
This only works if we're an Active Directory client then this certificate of counsel knows the types
of certificates we can request and from whom therefore it completes all the required fields for us.
We can also connect to the certification authority through the website.
This can also happen automatically.
We perform a certain operation that requires a certificate.
And if we don't have it we send a request which is processed.
We receive the certificate and complete the entire operation.
How do we verify that x 5 0 9 certificate.
We've already said that we must have a valid signature and they cannot be expired.
This however only applies to user certificates not authorities.
We also need to check whether the certificate has not been revoked and is used as intended.
We've already mentioned route certification authorities.
We had the opportunity to see a long list of certificates that we trust automatically.
We also mentioned that the certification of the root certification authority is unique because it's
issued to itself.
We already know where the relationship of trust comes from for all computers that were use on the Internet.
Now let's consider whether or not it's worth implementing our own public key infrastructure or if it
would be sufficient enough to buy certificates from companies such as Verisign or thought.