Red Hat NETWORK PROXY SERVER 3.7 - Uživatelský manuál stáhnout pdf (Strana 55)

3.1 How Server Security Works 45

privacy)andthe mutualauthentication betweenbrowsersandyour secure

web server. The CA-approved digital certiﬁcate provides authentication

(the CA puts its reputation behind a certiﬁcation of your organization’s

identity).

Encryption depends upon the use of keys (think of them as secret en-

coder/decoder rings in data format). In conventional or symmetric cryp-

tography, both ends of the transaction have the same key, which they use

to decode each other’s transmissions. In public or asymmetric cryptog-

raphy, two keys co-exist: a public key and a private key. A person or an

organization keeps their private key a secret, and publishes their public

key. Data encoded with the public key can only be decoded with the pri-

vate key; dataencoded with the private key can only be decoded with the

public key.

You’ll use public cryptography to create a public and private key pair.

Then you’ll create a certiﬁcate request, which contains your public key.

You send your certiﬁcate request, proof of your company’s identity and

payment toa CA.The CA veriﬁes thecertiﬁcate requestand your identity,

and then sends back a certiﬁcate for your secure web server.

Your secure web server needs a certiﬁcate signed by a CA, so that people

who visit your website know you are who you claim to be. When a web

browser connects to a secure website, the browser requests that the server

provide some evidence of its identity (or more importantly, the identity of

the organization behind the website). The certiﬁcate is signed by a CA,

which basically means that you can be assured of its validity. Before sign-

ing the certiﬁcate, the CA veriﬁed that the organization (in this case, you)

requesting the certiﬁcate was actually who they claimed to be.

Most web browsers that support SSL have a list of CAs whose certiﬁcates

they will automatically accept. If a browser encounters a certiﬁcate whose

authorizing CA is not in the list, the browser will ask the user to choose

whether to accept or decline the connection.

The process of getting a certiﬁcate is relatively easy and this chapter will

cover how to get one in detail. A quick overview is as follows: you create

anencryption keyand then acertiﬁcate requestbasedon thatkey. The cer-

tiﬁcate request contains information about your server and the company

hosting it. You sendthis certiﬁcaterequest, along withdocuments proving

your identity, to a CA. Once the CA is satisﬁed that you are indeed who

1 2 ... 50 51 52 53 54 55 56 57 58 59 60 ... 100 101

Žádné komentáře

Red Hat NETWORK PROXY SERVER 3.7 - Uživatelský manuál Strana 55