Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Administration Manual

Page: 27 / 512

How the Certificate System Works
7
1.2. How the Certificate System Works
The Certificate System manages certificates through a flexible, scalable system for issuing and
publishing certificates; creating and publishing CRLs; and providing key storage and retrieval
capabilities.
The Certificate Manager is the central point of the Certificate System; this subsystem accepts
requests, generates and manages certificates, and generates and manages CRLs and revoked
certificates. The Online Certificate Status Manager handles validity requests for certificates issued by
the Certificate Manager, informing clients whether the certificate is still in effect and valid or has been
revoked or expired. The Data Recovery Manager (DRM) stores keys and certificates and can recover
the keys if a token is lost or damaged, so that encrypted information can still be accessed. The Token
Key Service and Token Processing System work together to manage tokens which contain the user-
specific keys and certificates.
The following sections describe the subsystems in more detail.
1.2.1. About the Certificate Manager
The Certificate Manager subsystem provides the capability of a Certificate Authority (CA). It can issue,
revoke, and publish certificates, as well as compile and publish CRLs. Since the Certificate Manager
acts as a CA, it can be configured as a self-signing CA, where it is the root CA, or it can act as a
subordinate CA, where it obtains its signing certificate from another CA.
1.2.1.1. Certificate Manager Flexibility and Scalability
Multiple CAs can be configured to form a vertical or horizontal chain of CAs. A vertical hierarchy
has a root CA (that is either self-signing or subordinate to a public CA) and then one or more CAs
subordinate to this root CA. The subordinate CAs can have more CAs below them, forming a chain of
CAs. A horizontal arrangement has a CA which is duplicated, or cloned, so that two CAs are set up in
an identical manner and use the same CA signing certificate but issue certificates from a different set
of serial numbers.
The different possible Certificate Manager deployments provide flexibility to the PKI through the
following features:
• Configuration as either a root or subordinate CA
• High-availability cloning to allow CAs with identical functionality, keys, and certificates to issue
certificates with different sets of serial numbers.
1.2.1.1.1. Root or Subordinate CA
The Certificate System CA can function as a
root CA
, meaning that the server signs its own CA
signing certificate as well as other CA signing certificates, creating an organization-specific CA
hierarchy. The server can alternatively be configured as a
subordinate CA
, meaning the server's CA
signing key is signed by another CA in an existing CA hierarchy. See
Section 2.1.3, “Self-Signed Root
CA or Subordinate CA”
for details.
1.2.1.1.2. Linked CA
The Certificate System Certificate Manager can function as a
linked CA
, chaining up to many third-
party or public CAs for validation; this provides cross-company trust, so applications can verify