Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Руководство администратора

Страница: 415 / 564

TPS Certificates
393
16.1.5.2. Subsystem Certificate
Every member of the security domain is issued a server certificate to use for communications among
other domain members. The TKS is issued the subsystem certificate when the instance is first
configured, as with its SSL certificate.
The default nickname for the certificate is
subsystemCert cert-
instance_id
.
16.1.5.3. Audit Log Signing Key Pair and Certificate
The TKS keeps a secure audit log of all events which occurred on the server. To guarantee that the
audit log has not been tampered with, the log file is signed by a special log signing certificate.
The audit log signing certificate is issued when the server is first configured.
16.1.6. TPS Certificates
The TPS only uses three certificates: a server certificate, subsystem certificate, and audit log signing
certificate.
•
Section 16.1.6.1, “SSL Server Certificate”
•
Section 16.1.6.2, “Subsystem Certificate”
•
Section 16.1.6.3, “Audit Log Signing Key Pair and Certificate”
16.1.6.1. SSL Server Certificate
Every Certificate System TPS has at least one SSL server certificate. The first SSL server certificate
is generated when the TPS is configured. The default nickname for the certificate is
Server-Cert
cert-
instance_id
.
16.1.6.2. Subsystem Certificate
Every member of the security domain is issued a server certificate to use for communications among
other domain members. The TPS is issued the subsystem certificate when the instance is first
configured, as with its SSL certificate.
The default nickname for the certificate is
subsystemCert cert-
instance_id
.
16.1.6.3. Audit Log Signing Key Pair and Certificate
The TPS keeps a secure audit log of all events which occurred on the server. To guarantee that the
audit log has not been tampered with, the log file is signed by a special log signing certificate.
The audit log signing certificate is issued when the server is first configured.
16.1.7. Using an HSM to Store Subsystem Certificates
By default, keys and certificates are stored in locally-managed databases,
key3.db
and
cert8.db
,
respectively, in the
/var/lib/ subsystem_name /alias
directory. However, Red Hat Certificate
System also supports hardware security modules (HSM), external devices which can store keys
and certificates in a centralized place on the network. Using an HSM can make some functions, like
cloning, easier because the keys and certificates for the instance are readily accessible.