Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Руководство администратора, Страница: 26 / 564

Chapter 1. Overview of Red Hat Certificate System Subsystems
4
Certificate Type Use Example
may be used as both an S/
MIME certificate and an SSL
certificate. S/MIME certificates
can also be used as part of
single sign-on. email that deals with sensitive financial or legal
matters.
CA certificates Used to identify CAs. Client
and server software use
CA certificates to determine
what other certificates can be
trusted. The CA certificates stored in Mozilla Firefox
determine what other certificates can be
authenticated. An administrator can implement
corporate security policies by controlling the
CA certificates stored in each user's copy of
Firefox.
Object-signing certificates Used to identify signers of
Java code, JavaScript scripts,
or other signed files. Software companies frequently sign software
distributed over the Internet to provide users
with some assurance that the software is a
legitimate product of that company. Using
certificates and digital signatures can also
make it possible for users to identify and
control the kind of access downloaded
software has to their computers.
Table 1.1. Common Certificates
•
Section 1.1.2.1, “CA Signing Certificates”
•
Section 1.1.2.2, “Other Signing Certificates”
•
Section 1.1.2.3, “SSL Server and Client Certificates”
•
Section 1.1.2.4, “User Certificates”
•
Section 1.1.2.5, “Dual-Key Pairs”
•
Section 1.1.2.6, “Cross-Pair Certificates”
1.1.2.1. CA Signing Certificates
Every Certificate Manager has a CA signing certificate with a public/private key pair it uses to sign the
certificates and CRLs it issues. This certificate is created and installed when the Certificate Manager is
installed.
The Certificate Manager's status as a root or subordinate CA is determined by whether its CA signing
certificate is self-signed or is signed by another CA. Self-signed root CAs set the policies they use to
issue certificates, such as the subject names, types of certificates that can be issued, and to whom
certificates can be issued. A subordinate CA has a CA signing certificate signed by another CA,
usually the one that is a level above in the CA hierarchy (which may or may not be a root CA). If the
Certificate Manager is a subordinate CA in a CA hierarchy, the root CA's signing certificate must
be imported into individual clients and servers before the Certificate Manager can be used to issue
certificates to them.
The CA certificate must be installed in a client if a server or user certificate issued by that CA is
installed on that client. The CA certificate confirms that the server certificate can be trusted. Ideally, the
certificate chain is installed.