Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 515 / 554

How Certificates Are Used
493
These are the authentication steps shown in
Figure B.5, “Using a Certificate to Authenticate a Client to
a Server”
:
1. The client software maintains a database of the private keys that correspond to the public
keys published in any certificates issued for that client. The client asks for the password to this
database the first time the client needs to access it during a given session, such as the first
time the user attempts to access an SSL-enabled server that requires certificate-based client
authentication.
After entering this password once, the user does not need to enter it again for the rest of the
session, even when accessing other SSL-enabled servers.
2. The client unlocks the private-key database, retrieves the private key for the user's certificate,
and uses that private key to sign data randomly-generated from input from both the client and the
server. This data and the digital signature are evidence of the private key's validity. The digital
signature can be created only with that private key and can be validated with the corresponding
public key against the signed data, which is unique to the SSL session.
3. The client sends both the user's certificate and the randomly-generated data across the network.
4. The server uses the certificate and the signed data to authenticate the user's identity.
5. The server may perform other authentication tasks, such as checking that the certificate presented
by the client is stored in the user's entry in an LDAP directory. The server then evaluates whether
the identified user is permitted to access the requested resource. This evaluation process can
employ a variety of standard authorization mechanisms, potentially using additional information
in an LDAP directory or company databases. If the result of the evaluation is positive, the server
allows the client to access the requested resource.
Certificates replace the authentication portion of the interaction between the client and the server.
Instead of requiring a user to send passwords across the network continually, single sign-on requires
the user to enter the private-key database password once, without sending it across the network. For
the rest of the session, the client presents the user's certificate to authenticate the user to each new
server it encounters. Existing authorization mechanisms based on the authenticated user identity are
not affected.
B.4.3. How Certificates Are Used
The following sections cover common certificate types and when these certificates are commonly
used.
•
Section B.4.3.1, “Types of Certificates”
•
Section B.4.3.2, “SSL”
•
Section B.4.3.3, “Signed and Encrypted Email”
•
Section B.4.4, “Single Sign-on”
B.4.3.1. Types of Certificates
Five kinds of certificates are commonly used: