Netscape Certificate Management System 6.1, Руководство администратора

Страница: 782 / 840

Certificates and Authentication
782 Managing Servers with Netscape Console • December 2001
DNs may include a variety of other name-value pairs. They are used to identify
both certificate subjects and entries in directories that support the Lightweight
Directory Access Protocol (LDAP).
The rules governing the construction of DNs can be quite complex and are beyond
the scope of this document. For comprehensive information about DNs, see A
String Representation of Distinguished Names at the following URL:
http://www.ietf.org/rfc/rfc1485.txt
A Typical Certificate
Every X.509 certificate consists of two sections:
• The data section includes the following information:
• The version number of the X.509 standard supported by the certificate.
• The certificate’s serial number. Every certificate issued by a CA has a serial
number that is unique among the certificates issued by that CA.
• Information
• Information about the user’s public key, including the algorithm used and a
representation of the key itself.
• The DN of the CA that issued the certificate.
• The period during which the certificate is valid (for example, between 1:00 p.m.
on November 15, 1999 and 1:00 p.m. November 15, 2000)
• The DN of the certificate subject (for example, in a client SSL certificate this
would be the user’s DN), also called the subject name.
• Optional certificate extensions, which may provide additional data used by the
client or server. For example, the certificate type extension indicates the type of
certificate—that is, whether it is a client SSL certificate, a server SSL certificate,
a certificate for signing email, and so on. Certificate extensions can also be used
for a variety of other purposes.
• The signature section includes the following information:
• The cryptographic algorithm, or cipher, used by the issuing CA to create its
own digital signature. For more information about ciphers, see Appendix K,
“Introduction to SSL.”
• The CA’s digital signature, obtained by hashing all of the data in the certificate
together and encrypting it with the CA's private key.