X.509 Certificate Contents
Last updated
Segurança Em Redes De Comunicações
Last updated
Version.
Serial Number.
Signature Algorithm.
Issuer Name.
Validity Period.
Subject Name.
Distinguished Name (DN) of the entity.
CN=Java Duke, OU=Java Software Division, O=U.Aveiro, C=PT.
Subject Public Key Information.
Public Key Algorithm.
Subject Public Key.
Certificate Signature Algorithm.
Certificate Signature.
Simple Certificate Enrollment Protocol (SCEP) is used for the secure transportation of key information and certificates.
Enrolling in a Certificate Authority.
The end host generates a private-public key pair.
The end host generates a certificate request, which it forwards to the CA.
Manual, human intervention is required to approve the enrollment request.
After the approval, the CA signs the certificate with its private key and returns the completed certificate to the end host.
End host stores certificate.
The CRL is another crucial PKI component.
This is a list of certificates that were formerly valid within the PKI but have been revoked for some reason.
These reasons could include any of the following:
Compromise of keys within the certificate.
Loss of access privileges for user/device.
Change of PKI structure requiring certificate re-issue.
The cert is being presented within its validity period.
The CA that signed the cert is known and trustable.
The certificate is not on a revocation list (optional in some scenarios).
