The links above are pretty decent for getting things going. If you would like more conceptual information, this is a great site and makes a complex topic a little easier to swallow and follow:
http://www.carillon.ca/tut
The quick idea is this:
Root CA signs its own cert. You know the root provider and decide to trust them by installing their root cert; or, you trust a software vendor (e.g. Microsoft, Apple, Mozilla) enough to accept their trusted certificates provided in their products (e.g. IE, Safari, FireFox).
Since you trust the root, you trust everything signed by it in a hierarchy fashion. Typically the root CA should be offline for maximum security and a second (occasionally 3rd or 4th) tier CA will issue the bulk of the certs to users & computers. Issued certificates will contain an Authority Information Access (AIA) location (e.g. URL, LDAP, etc.) to point to the various CA certs up to the root, which is usually hosted on a normal web server copied from the CA.
Since life happens, you want to make sure the cert was not compromised, so the CA will issue a Certificate Revocation List (CRL) to a similar location to the AIA, this one being the CRL Distribution Point (CDP).
The software (e.g. browser) will have a crypto engine built in to check all this stuff for you and only report issues. It will verify you trust the root, can access the CA certs from the AIA, check to make sure it wasn't revoked in the CRL downloaded from the CDP, and check conditions within the certificate such as that the subject name of the user or site matches what you are validating (e.g. site address portion of URL) and that it has not expired. If everything checks out, it is transparent beyond you get the little gold lock in your browser or other similar icon for other functions like email.
There are two primary uses: digital signing and encryption. Signing validates the identity, like checking a drivers license. Encryption protects data from unauthorized access.
Main Topics
Browse All Topics
by: farazhkhanPosted on 2009-11-04 at 01:36:54ID: 25737670
Hi,
It requires lot of reading and attention. You can start with reading these
http://www.windowsecurity.
http://www.windowsecurity.
http://www.windowsecurity.
http://www.windowsecurity.
Regards,
Faraz H. Khan