Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 797 / 840

Managing Certificates
Appendix J Introduction to Public-Key Cryptography 797
Renewing and Revoking Certificates
Like a driver’s license, a certificate specifies a period of time during which it is valid.
Attempts to use a certificate for authentication before or after its validity period will fail.
Therefore, mechanisms for managing certificate renewal are essential for any certificate
management strategy. For example, an administrator may wish to be notified automatically
when a certificate is about to expire, so that an appropriate renewal process can be
completed in plenty of time without causing the certificate’s subject any inconvenience.
The renewal process may involve reusing the same public-private key pair or issuing a new
one.
A driver’s license can be suspended even if it has not expired—for example, as punishment
for a serious driving offense. Similarly, it’s sometimes necessary to revoke a certificate
before it has expired—for example, if an employee leaves a company or moves to a new job
within the company.
Certificate revocation can be handled in several different ways. For some organizations, it
may be sufficient to set up servers so that the authentication process includes checking the
directory for the presence of the certificate being presented. When an administrator revokes
a certificate, the certificate can be automatically removed from the directory, and
subsequent authentication attempts with that certificate will fail even though the certificate
remains valid in every other respect. Another approach involves publishing a certificate
revocation list (CRL)—that is, a list of revoked certificates—to the directory at regular
intervals and checking the list as part of the authentication process. For some organizations,
it may be preferable to check directly with the issuing CA each time a certificate is
presented for authentication. This procedure is sometimes called real-time status checking.
Registration Authorities
Interactions between entities identified by certificates (sometimes called end entities) and
CAs are an essential part of certificate management. These interactions include operations
such as registration for certification, certificate retrieval, certificate renewal, certificate
revocation, and key backup and recovery. In general, a CA must be able to authenticate the
identities of end entities before responding to the requests. In addition, some requests need
to be approved by authorized administrators or managers before being services.
As previously discussed, the means used by different CAs to verify an identity before
issuing a certificate can vary widely, depending on the organization and the purpose for
which the certificate will be used. To provide maximum operational flexibility, interactions
with end entities can be separated from the other functions of a CA and handled by a
separate service called a
Registration Authority (RA).