guide to windows certification and public keys.pdf

(1315 KB) Pobierz
Aelita.Exchange.01_
Sponsored by
IT Pro SERIES
Books
Guide to
Windows
Certification
& Public Keys
By Jan De Clercq, Brett Hill, John Savill,
and Randy Franklin Smith
A
104590056.004.png 104590056.005.png
i
Contents
Chapter 1: Uncover PKI and Certificate Services in
by Jan De Clercq
Windows 2003 Certificate Services Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Certificate Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Automated Certificate Enrollment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Centralized Key Archival . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Certificate Request Approval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
The Best CA for the Job . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
by Jan De Clercq
Hierarchical Trust Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
by Jan De Clercq
by Jan De Clercq
Certificate-Validation Checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
CTL Certificate-Chain Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
104590056.006.png 104590056.007.png
ii A Guide to Windows Certification and Public Keys
by Jan De Clercq
How Autoenrollment Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
by Jan De Clercq
Certificate Revocation Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
CRL Distribution Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Netscape Revocation Extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
by Jan De Clercq
Configuring Automatic Key Archival and Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
by Randy Franklin Smith
Adding X . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Obtaining Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
104590056.001.png
iii
Obtaining a Server Certificate from Your Own CA . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
by Randy Franklin Smith
by Randy Franklin Smith
by Brett Hill
by Jan De Clercq
Addressing ActiveX Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
by John Savill
by John Savill
IIS Client Service Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
by Jan De Clercq
by Randy Franklin Smith
by Randy Franklin Smith
by Paul Robichaux
104590056.002.png
1
Chapter 1
Uncover PKI and Certificate Services
—by Jan De Clercq
The core component of the Windows Server 2003 public key infrastructure (PKI) software is the
Certification Authority (CA), which Microsoft often refers to as the Certificate Server or Certificate
Services. A CA receives and processes PKI user certificate requests, identifies and validates those
requests, issues certificates according to the PKI’s security policy, renews and revokes certificates,
publishes certificates to different locations, creates and publishes certificate revocation lists (CRLs), and
logs all certificate and CRL transactions to the appropriate database. A Windows 2003 CA can also
perform secure private key archival and recovery. To better understand how CAs and PKI have
evolved in Windows 2003, let’s examine the components of the latest Certificate Services architecture
and the differences between establishing an enterprise CA and a standalone CA in Windows 2003.
Windows 2003 Certificate Services Architecture
The Windows 2003 Certificate Services architecture is almost identical to the architecture that
Microsoft used for previous editions of Certificate Services. A key difference is that Microsoft modified
the CA database layout to let the CA archive and recover PKI users’ private keys. Figure 1 shows the
architecture, which includes various modules, databases, administrative tools, intermediaries, and
CryptoAPI.
Brought to you by Thawte and Windows IT Pro eBooks
in Windows Server 2003
104590056.003.png

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin