
Appendix Certificates and Security 95
Certificate Authorities (CA)
A Certificate Authority (CA) is an entity which signs and issues digital identity
certificates claiming trust of the identified party. In this sense, it’s a trusted third party
between two transactions.
In x.509 systems, CAs are hierarchical in nature, with CAs being certified by CAs, until
you reach a “root authority.” The hierarchy of certificates is always a top-down, with a
root authority’s certificate at the top. A root authority is a CA that’s trusted by enough
or all of the interested parties, so that it doesn’t need to be authenticated by yet
another trusted third party.
A CA can be a company that, for a fee, signs and issues a public key certificate which
states that the CA attests that the public key contained in the certificate belongs to its
owner, as recorded in the certificate. In a sense, CA is a “digital notary public.” One
applies to the CA for a certificate by providing identity and contact information, as well
as the public key. A CA must check an applicant’s identity, so that users can trust
certificates issued by that CA to belong to the identified applicant.
Identities
Identities, in the context of the Mac OS X Server Certificate Manager, are the
combination of a signed certificate for both keys of a PKI keypair. The identities are
used by the system keychain, and are available for use by various services that support
SSL.
Self-Signed Certificates
Self-signed certificates are certificates that are digitally signed by the private key of the
keypair included in the certificate. This is done in place of a CA signing the certificate.
By self-signing a certificate, you’re attesting that you are who you say you are. No
trusted third party is involved.
Certificate Manager in Server Admin
Mac OS X Server’s Certificate Manager is integrated into Server Admin to help you
create, use, and maintain identities for SSL-enabled services.
Certificate Manager provides integrated management of SSL certificates in Mac OS X
Server for all services that allow the use of SSL certificates.
The Certificate Manager allows creation of self-signed certificates, and certificate-
signing requests (CSRs), to obtain a certificate signed by a CA. The certificates, either
self-signed, or signed by a CA, are accessible by the services that support SSL.
Identities that were previously created and stored in OpenSSL files can also be
imported into the Certificate Manager, and are then accessible to all the services that
support SSL.
Comentários a estes Manuais