Growing a Tree Of Trust -- Part One

Work Performed By Certificate Authorities

Key and certificate management are not tasks to be taken lightly. Nor are they for the faint-of-heart. Extremely tight security is an imperative to maintain the trust that PKIs require. At their essence, CAs provide 3 basic services to the entities (other CAs or end-entities) directly below them in the tree:

Certificate Issuance

Certificate Renewal

Certificate Revocation

Root Certificate authority

The highest level, or root, of the hierarchy of trust is the Root Certificate authority. It''s normally maintained off-line and only accessed when needed for signing purposes. Root CA responsibilities also include the generation and distribution of the Certificate Revocation List (CRL) in cases of any private key compromise in the branches directly below the root. Root Certificates are self-signed. Their presence is required for validating a PKI certificate chain. Enterprise root certificates will normally be imbedded in the Web browsers used to access PKI-protected resources.

What''s A Certificate Revocation List (CRL)?

The idea behind CRLs is to stop the uses of any digital certificates that are related to a set of private keys that were compromised (stolen). If a thief gains a copy of a private key and possesses its accompanying certificate, they''ve essentially stolen the identity of the private key holder. If the theft is not detected, the thief could use the key-pair (certificate and private key) to either: (a) masquerade as the legitimate keyholder without any suspicion or, (b) they could use the private key to sign forged certificates (if a CA key was stolen). Once a theft or compromise is detected, it''s critical that the CA which signed the key-pair knows about it and places the certificate''s serial number on the Certificate Revocation List immediately and re-publishes the list.

CRLs are defined by the X.509 Standard for publication and distribution of the identity of revoked, unexpired certificates. CRLs are composed of the serial numbers for all revoked certificates, with the CA that signed those certificates responsible for its near real-time maintenance to prevent any fraud or abuses using compromised private keys.