In this section of the course,
we're going to discuss Public Key Infrastructure
or PKI Architecture.
The Public Key Infrastructure Architecture section
of the course focuses on Domain 2: Security Architecture,
specifically objective 2.4,
which states that given a scenario,
you must be able to apply security concepts
to the design of access,
authentication and authorization systems.
The Public Key Infrastructure is the backbone
of secure online communication.
The Public Key Infrastructure
provides a framework for managing digital certificates,
which are the foundation of digital trust.
Trusted organizations, known as Certificate Authorities,
are responsible for issuing and managing certificates.
In use, proper validation of certificates
ensures authenticity and integrity
of digital communications and data exchanges.
Finally, the public key infrastructure
enables certificates to be efficiently deployed
across networks, servers, and client devices
to safeguard data
and maintain secure communication channels.
As we go through this section,
we will cover many topics
related to the Public Key Infrastructure Architecture,
including Certificate Management,
Certificate Authority Functions,
Certificate Validation, and Certificate Deployment.
First, we will look at Certificate Management.
Certificate management is the process of issuing,
renewing, revoking, and managing digital certificates
throughout their lifecycle.
Certificate management concepts
include certificate types and certificate extensions.
Certificate types refer to various forms
of digital certificates,
such as transport layer security or TLS certificates,
client certificates and code signing certificates.
Each type of certificate serves a different purpose
within the public key infrastructure framework.
Certificate extensions are fields in a digital certificate
that provide information
about the certificate's intended usage.
For example, a Transport Layer Security certificate
might include a field
called a Subject Alternative Name or SAN
that allows the certificate
to apply to a multitude of domains or subdomains.
Next, we will explore Certificate Authority
or CA functions.
Certificate Authority functions
include issuing, managing,
revoking, and validating digital certificates
to ensure trust and communications.
Applying certificate authority function concepts
requires a good understanding
of Certificate Authorities and Registration Authorities.
Certificate Authorities are trusted entities
responsible for generating and signing digital certificates,
thereby establishing the identity of certificate holders
within the Public Key Infrastructure framework.
A Root Certificate Authority
is a special type of Certificate Authority
that is the top most authority
in a Public Key Infrastructure hierarchy.
Root Certificate Authorities are trusted to issue
and sign digital certificates,
including their own,
and they serve as the foundation
for all subsequent trust relationships
in the certificate chain.
Registration Authorities act as intermediaries
between the end users and the Certificate Authorities.
Registration Authorities may perform tasks,
such as verifying the identity of certificate requesters
before a certificate is signed by a Certificate Authority.
For example, if an organization
requests a Transport Layer Security certificate,
a Registration Authority may
verify the organization's details.
Upon successful verification,
the Registration Authority
will vouch for its findings to a Certificate Authority.
The Certificate Authority may then issue the certificate.
After that, we will look at Certificate Validation.
Certificate validation
within the Public Key Infrastructure architecture
ensures that a digital certificate remains trustworthy,
is unexpired and has not been revoked.
Certificate validation concepts
include Online Certificate Status Protocol Stapling,
the Certificate Revocation List, and Certificate Pinning.
Online Certificate Status Protocol
or OCSP Stapling is a method of validation
that requires a server to provide a digitally signed proof
of its certificate's validity directly to the client.
In this way,
Online Certificate Status Protocol Stapling
removes the need
for a client to query a certificate authority directly
to validate a certificate.
Next, a Certificate Revocation List or CRL
is a list maintained by a Certificate Authority
that contains the serial numbers of certificates
that have been revoked before their expiration dates.
In this way,
a Certificate Revocation List
also allows clients
to determine if a certificate is still valid.
Finally, Certificate Pinning
involves storing a known valid certificate or public key
in an application.
During a connection,
an application can compare the stored certificate
or key against the one presented by the server.
If they match, trust is established
and the presented certificate is accepted.
For example, when a user connects to a website,
Online Certificate Status Protocol stapling
allows the server to prove that its certificate is valid.
Meanwhile,
the client may consult a Certificate Revocation List
to ensure the certificate hasn't been revoked,
and use certificate pinning
to confirm the presented certificate
matches an expected value.
Utilizing multiple methods of certificate validation
results in layering multiple validation mechanisms
for better security.
Finally, we will look at Certificate Deployment.
Certificate deployment involves the distribution
and installation of digital certificates across systems
and devices to enable secure communications.
Certificate deployment concepts include template use,
deployment approach, and integration approach.
Templates are predefined configurations
that standardize the settings
and permissions of certificates.
Templates make the deployment process more efficient
by ensuring consistency across issued certificates.
Next, the term deployment approach
refers to the method used to distribute
and install certificates across servers,
client machines, network devices, and applications.
A deployment approach
may include manual certificate installation
or automated processes using management tools.
Finally, the integration approach describes
how certificates are incorporated into existing systems.
Incorporation includes the setup
of the necessary infrastructure
to support secure communications,
such as configuring email servers
to use Secure/Multipurpose Internet Mail Extensions
or S/MIME certificates
for encrypting and signing emails or configuring web servers
to present Transport Layer Security certificates.
For example, an organization might use a template
to define a standard Transport Layer Security Certificate.
Automate the deployment of these certificates
across multiple servers,
and integrate them into their web infrastructure
to ensure all servers are secured consistently
and efficiently.
To finish things off,
we will take a short quiz
to see what you learned during this section of the course,
and we will review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So, let's get ready
to dive into Public Key Infrastructure Architecture
in this section of the course!