![background image](http://html2.mh-extra.com/html/xerox/d-series/d-series_security-manual_3486966023.webp)
Xerox® Security Guide for Light Production Mono Class Products
Public Key Encryption (PKI)
A digital certificate is a file that contains data used to verify the identity of the client or server in a network
transaction. A certificate also contains a public key used to create and verify digital signatures. To prove
identity to another product, a product presents a certificate trusted by the other product. The product can
also present a certificate signed by a trusted third party and a digital signature proving that it owns the
certificate.
A digital certificate includes the following data:
• Information about the owner of the certificate
• The certificate serial number and expiration date
• The name and digital signature of the certificate authority (CA) that issued the certificate
• A public key
• A purpose defining how the certificate and public key can be used
There are four types of certificates:
• A Product Certificate is a certificate for which the printer has a private key. The purpose specified in the
certificate allows it to be used to prove identity.
• A CA Certificate is a certificate with authority to sign other certificates.
• A Trusted Certificate is a self-signed certificate from another product that you want to trust.
• A domain controller certificate is a self-signed certificate for a domain controller in your network.
Domain controller certificates are used to verify the identity of a user when the user logs in to the product
using a Smart Card.
For protocols such as HTTPS, the printer is the server, and must prove its identity to the client Web
browser. For protocols such as 802.1X, the printer is the client, and must prove its identity to the
authentication server, typically a RADIUS server.
Device Certificates
Legacy and D-Series® products support both CA signed and self-signed certificates. Product certificates
support a bit length of up to 2048 bits.
A CA signed certificate can be created by generating a Certificate Signing Request (CSR), and sending it
to a CA or a local server functioning as a CA to sign the CSR. An example of a server functioning as a
certificate authority is Windows Server 2008 running Certificate Services. When the CA returns the signed
certificate, install it on the printer.
Alternatively, a self-signed certificate may be created. When you create a Product Certificate, the product
generates a certificate, signs it, and creates a public key used in SSL/TLS encryption.
Legacy Printers
Legacy Copier/Printers D-Series® Copier/Printers
4110, 4112/4127, 4590
EPS
4110, 4112/4127, 4590
D95/D110/D125/D136
Device Certificates
Certificate Length
1024, 2048
1024, 2048
1024, 2048
Supported Hashes
SHA1, SHA256
SHA1, SHA256, SHA384,
SHA512
SHA2, SHA256, SHA384,
SHA512
Product Web Server
Supported
Supported
Supported
IPPS (TLS) Printing
Supported
Supported
Supported
802.1X Client
Supported
Supported
Supported
Email Signing
Supported
Supported
Supported
Email Encryption
Supported
Supported
Supported
OCSP Signing
Supported
Supported
Supported
IPSec
Supported
Supported
Supported
SFTP
Supported
Supported
Supported