Notes - MIECT
Segurança Em Redes De Comunicações
Notes - MIECT
Segurança Em Redes De Comunicações
  • Segurança Em Redes De Comunicações
  • Corporate Networks Topics
    • Objectives of Network Design
    • Equipments
    • Hierarchical Network Model
    • Modular Network Design
    • Designing the Access Layer
    • Designing the Core Layer
    • Virtual LANs
      • VLANs on Access Points
    • Spanning Tree Protocol
    • IP Routing Overview
  • Introduction to Network Security
    • Type of Attacks
    • Attacks Phases
      • Infiltration Phase
      • Propagation Phase
      • Aggregation and Exfiltration Phase
    • Defenses
    • Security Metrics
  • Network Access Control
    • AAA Architecture
      • TACACS+
      • RADIUS
      • DIAMETER
    • IEEE 802.11 services
    • Joining a BSS
      • WLAN Frames
      • Joining BSS with AP
    • WPA and 802.11i (WPA2)
  • Network Flow Control
    • Network Security Systems
    • Firewalls
    • High-Availability
    • Load Balancing Firewall Load
    • Best Practices and Recommendations
    • IP Spoofing
    • Half-Open TCP Connection Problem
    • DDoS Mitigation at Source
    • Cisco’s Access Control Lists (ACL)
    • Linux IPTables
    • Control By Analysis of Higher Layers
  • Secure Communications
    • Public Key Infrastructure (PKI)
    • X.509 Certificate Contents
    • Traffic Tunnel Concept
      • Next Hop Resolution Protocol (NHRP)
      • Hub-Spoke vs. Spoke-Spoke
    • IPSec
    • Establishing SA and Cryptographic Keys
    • Virtual Private Networks (VPN)
    • Management of Asymmetric Keys
  • Remote Access
    • Remote Access
    • IPsec NAT Transversal
    • Integration with Flow Control
  • Intrusion Detection and Prevention
    • Intrusion Detection and Prevention
    • Host-Based vs. Network-Based
    • Signature vs. Anomaly Based
    • Network Deployment
  • Network Monitoring SIEM
    • Core and End-to-End Monitoring
    • Node Monitoring
    • End-User/Host/App Monitoring
    • Server/Service/Cloud Monitoring
    • Per-Service Detailed Monitoring
    • Data Sources
      • SNMP
      • NetFlow
    • Network Passive Probing Packet Capturing
    • Remote CLI Access
    • Log Files Access
      • Log Management Systems (LMS)
      • Security Information and Events Management (SIEM)
Powered by GitBook
On this page
  • Certificate Authority enrollment
  • Certificate Revocation Lists (CRL)
  • Usage and validity check
  1. Secure Communications

X.509 Certificate Contents

PreviousPublic Key Infrastructure (PKI)NextTraffic Tunnel Concept

Last updated 2 years ago

  • Version.

  • Serial Number.

  • Signature Algorithm.

  • Issuer Name.

  • Validity Period.

  • Subject Name.

    • Distinguished Name (DN) of the entity.

    • CN=Java Duke, OU=Java Software Division, O=U.Aveiro, C=PT.

  • Subject Public Key Information.

    • Public Key Algorithm.

    • Subject Public Key.

  • Certificate Signature Algorithm.

  • Certificate Signature.

Certificate Authority enrollment

Simple Certificate Enrollment Protocol (SCEP) is used for the secure transportation of key information and certificates.

Enrolling in a Certificate Authority.

  1. The end host generates a private-public key pair.

  2. The end host generates a certificate request, which it forwards to the CA.

  3. Manual, human intervention is required to approve the enrollment request.

  4. After the approval, the CA signs the certificate with its private key and returns the completed certificate to the end host.

  5. End host stores certificate.

Certificate Revocation Lists (CRL)

The CRL is another crucial PKI component.

This is a list of certificates that were formerly valid within the PKI but have been revoked for some reason.

These reasons could include any of the following:

  • Compromise of keys within the certificate.

  • Loss of access privileges for user/device.

  • Change of PKI structure requiring certificate re-issue.

Usage and validity check

The cert is being presented within its validity period.

The CA that signed the cert is known and trustable.

The certificate is not on a revocation list (optional in some scenarios).