A certificate server is a server that issues (and typically validates) public key certificates as part of a public key infrastructure.
Contents
- X509 description
- Implementation using Microsoft IIS
- Privacy concerns with Microsoft certificates
- Open source implementations
- Implementation using Apache modssl
- References
The server in question must be either a:
Even if a certificate server is only issuing a self-signed certificate for its own use, it is still the root certificate authority for that certificate.
X.509 description
The certificates and roles described above are defined in the ITU X.509 standard and Internet Engineering Task Force RFC 2459, entitled "Internet X.509 Public Key Infrastructure Certificate and CRL Profile". These standards describe both the format of the X.509 v3 certificate and X.509 v2 certificate revocation list as the processes by which a certificate authority may issue and revoke digital certificates.
According to the RFC, "The goal of this specification is to develop a profile to facilitate the use of X.509 certificates within Internet applications for those communities wishing to make use of X.509 technology. Such applications may include WWW, electronic mail, user authentication, and IPsec."
In plain English, digital certificates (and their associated public key infrastructure) allow an electronic message to be encrypted in such a way that:
Implementation using Microsoft IIS
Microsoft's Certificate Services on IIS allows a server to issue or revoke digital certificates. The specific implementation requires a dedicated certificate server in one of four configurations as certificate authorities.
Management of Certificate Services is done via a Microsoft Management Console snap-in, and a web-based application. These programs can be used to view revoked, issued, pending, and failed requests for certificates.
Privacy concerns with Microsoft certificates
Certificate authentication is built into recent versions of IE and cannot be turned off. Automatic checking of the validity of certificates at Microsoft's certificate authority may provide Microsoft with a database of sites visited, files downloaded, the unique ID of the user's computer, the user's IP address and other information. As such, use of this automated security feature may represent a considerable privacy concern (which may also conflict with existing EU regulations regarding privacy). Most users may be unaware that their identity and specific web browsing habits are being stored centrally via Microsoft's browser and may be subject to subsequently being resold or subpoenaed.
Open source implementations
There exist several open source implementations of certificate servers, commonly referred to as a CA or certificate authority. Common for all is that they provide the services to issue, revoke and manage digital certificates.
Some well known open source implementations are:
Implementation using Apache + mod_ssl
Apache can use a certificate server to get certificates used to provide secure communications with the SSL/TLS protocol.
The server based implementation of the Apache HTTP Server is "mod_ssl", a derivation of Apache-SSL based on the functionality of OpenSSL. Mod_ssl features support for SSLv2, SSLv3, and TLSv1, with X.509 client/server based authentication and certificate revocation. This is accomplished via three packages: the mod_ssl package, an extended API, and an SSL/TLS implementation toolkit such as OpenSSL.