Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Руководство администратора

Страница: 526 / 554

Appendix B. Introduction to Public-Key Cryptography
504
procedures for issuing different kinds of certificates. Requirements for receiving a certificate can be as
simple as an email address or username and password to notarized documents, a background check,
and a personal interview.
Depending on an organization's policies, the process of issuing certificates can range from being
completely transparent for the user to requiring significant user participation and complex procedures.
In general, processes for issuing certificates should be flexible, so organizations can tailor them to
their changing needs.
The Certificate System allows an organization to set up its own CA and issue certificates.
B.5.2. Certificates and the LDAP Directory
The Lightweight Directory Access Protocol (LDAP) for directory services offers flexibility in managing
certificates within an organization. System administrators can store much of the information required
to manage certificates in an LDAP-compliant directory. For example, a CA can use information in a
directory to prepopulate a certificate with a new employee's legal name and other information. The CA
can leverage directory information in other ways to issue certificates one at a time or in bulk, using a
range of different identification techniques depending on the security policies of a given organization.
Other routine management tasks, such as key management and revoking certificates, can be partially
or fully automated with the aid of the directory.
Information stored in the directory can also be used with certificates to control access to network
resources by different users or groups. Issuing certificates and other certificate management tasks can
be an integral part of user and group management.
High-performance directory services are an essential ingredient of any certificate management
strategy. For the Certificate System to function, there must be a Red Hat Directory Server installed to
support the LDAP directory services.
B.5.3. Key Management
Before a certificate can be issued, the public key it contains and the corresponding private key must
be generated. Sometimes it may be useful to issue a single person one certificate and key pair for
signing operations and another certificate and key pair for encryption operations. Separate signing
and encryption certificates keep the private signing key only on the local machine, providing maximum
nonrepudiation. This also aids in backing up the private encryption key in some central location where
it can be retrieved in case the user loses the original key or leaves the company.
Keys can be generated by client software or generated centrally by the CA and distributed to users
through an LDAP directory. There are costs associated with either method. Local key generation
provides maximum nonrepudiation but may involve more participation by the user in the issuing
process. Flexible key management capabilities are essential for most organizations.
Key recovery
, or the ability to retrieve backups of encryption keys under carefully defined conditions,
can be a crucial part of certificate management, depending on how an organization uses certificates.
In some PKI setups, several authorized personnel must agree before an encryption key can be
recovered to ensure that the key is only recovered to the legitimate owner in authorized circumstance.
It can be necessary to recover a key when information is encrypted and can only be decrypted by the
lost key.