Administration itself consists of the fact that we must manage the certification authorities and the
certificates.
These two rules should be separated.
This is also stated in the Common Criteria standard.
No public key infrastructure should fulfill more than one administrative role in it.
Windows force is compliance with this by a separation of four roles.
We can not be the certification authority administrator and the certificate manager at the same time
to enable the separation of the roles we need to return again to the search tool.
At the end a few words about responsibility certification authority management includes such obligations
as the installation and configuration of those authorities.
Certificate renewals.
The certification authorities themselves as well as the monitoring of their activity.
It's important to appoint key recovery agents.
This is because we may store private keys of users in the certification authority.
We have seen earlier that a private user does not leave the computer or smart card.
However the certification authority can be configured to ask the user to send this key.
Then it will be encrypted and stored in the Agent database The idea is that if something happens to
the key on the user's side we will be able to restore it to him.
There is no need to perform fairly complex operations such as.
On behalf of the user decrypt his files so they could continue to use them who receive a copy of the
key and can decrypt the files himself.
You also need to make backups just as on all computers
certificate management consists of preparing templates publishing these templates processing requests
to issue certificates revoking certificates and publishing the certificate revocation list the creation
or recovery of backup or user's private keys is an operation that involves more than one person.
Otherwise it would be a violation of the basis of trust.
Someone else has to have our private key
since the private key is encrypted in the certification authority database.
One person can download it and another person decrypted these persons must cooperate with each other.
The chances are much less that they will cooperate with wrong intentions.
Templates show however what the certificate will be used for in Windows Server 2008.
We can use the first second or third version as the name suggests.
The template is an example.
We can modify the template for our own needs.
As long as we use the appropriate addition of windows in the standard version we can only use one of
the predefined templates installed together with the operating system
an important point is also the issue of revoking certificates.
If we suspect that the key has fallen into the wrong hands or that the certification authority has been
completely compromised or simply a user no longer works for a company or changed his position and now
the old certificate does not match then we have to revoke it.
In order to revoke the certificate its number must be placed on the certificate relocation list
the whole list is of course digitally signed.
We have seen that the root certification authority has the requirement to publish such a list every
12 weeks as we configured
the less frequently we publish a S.R.O list the longer someone may use a compromised certificate.
But if we publish it too frequently will generate lots of traffic on the network certificate evocation
list can be quite long.
The serial numbers of all the revoked certificates from the beginning of the authorities life for their
Each time the entire list is downloaded to the computer.
The solution is to publish a list of differences
on the list the differences are only certificates revoked since the publication of the last full certificate
evocation list all newer Windows systems support a differential mode.
We mentioned briefly the topic of archiving keys.
Now let's look at the process of key backup and recovery.
The user may lose the key that matches the public key issued on the basis of a certificate in which
the backup option was enabled.
The archiving option is enabled for example for each of us certificates.
It is generally enabled for certificates which allow encryption but it is not enabled for certificates
to permit confirming identity.
The user who has lost such a key submits a request to obtain its copy first.
This key must go to the certification authority.
The private key generated by the user once admitting that certificate request is encrypted with the
public key.
The certification authority and attached to the request to issue the certificate
the certification authority decrypts this key and then encrypts it with the recovery key and saves it.
We have someone whom we call the key recovery agent
suppose that now the user has lost the key and would like to recover it from the backup.
The certificate manager is the only person who is entitled to read the encrypted key from the certification
authority database.
You can read it but he cannot see it because it's encrypted.
At this point the certificate manager sends the use of the encrypted key through the PKC number 7 format
to the key recovery agent.
This is the only person who can decrypt.
He has the key to which the private key was previously encrypted.
The task of the agent is only sending the decrypted key to the user in this module We've briefly presented
the principle of the operation concept and functionality of the public key infrastructure.
We've mentioned what the solution is used for and why it's worth implementing our own public key infrastructure.
We've also spoken briefly about the issues related to the control and management of such an infrastructure.
Thank you for your time.