X.509 Certificate - Revision history

Tom: /* References */

2022-07-30T18:48:48Z

‎References

Tom: /* Web Site Trust */

2022-07-30T18:48:16Z

‎Web Site Trust

Tom: /* Problems */

2021-11-11T01:05:43Z

‎Problems

Tom: /* Context */

2021-08-26T22:54:12Z

‎Context

Tom: /* Context */

2021-08-23T18:20:14Z

‎Context

Tom: /* Context */

2021-08-23T18:18:43Z

‎Context

Tom: /* Problems */

2021-08-23T17:48:21Z

‎Problems

Tom: /* Context */

2021-08-23T17:47:21Z

‎Context

Tom: /* Context */

2021-08-23T17:46:24Z

‎Context

Tom: /* Cert to json */

2021-07-16T00:40:52Z

‎Cert to json

← Older revision		Revision as of 18:48, 30 July 2022
Line 115:		Line 115:


−	[[Category:Glossary]]	+	[[Category: Glossary]]
−	[[Category:Identifier]]	+	[[Category: Trust]]
		+	[[Category: Identifier]]

@@ Line 34: / Line 34: @@
 ====Web Site Trust====
-[[Web Site Security]] in early 2019 was dependent on the use of [[X.509 Certificate]]s. The rest of the section will discuss the best way to support that, the [[Web Site Security]] page discusses alternate means for [[Web Platform Identifier]]s that are currently under development.
+*[[Web Site Security]] in early 2019 was dependent on the use of [[X.509 Certificate]]s. The rest of the section will discuss the best way to support that, the [[Web Site Security]] page discusses alternate means for [[Web Platform Identifier]]s that are currently under development.
+* Each browser (or other [[User Agent]] is supplied with a list or acceptable root Certificate Authorities. Some security conscious organizations either supply their own list of accept certificates or ask users to add some of their own to the default list. Fore example the [https://www.cnss.gov/CNSS/help/DoD_Root_Cert_Help_Final.pdf DoD requests users to add their certificate to others on the user's browser.]
-On Windows the tools for creating a secure web site are fragmented due their original purpose, which was simply to enable certificates on Windows Active Directory Domains. The web page at [https://windowsserveressentials.com/2013/02/06/manually-creating-a-certificate-request-windows-server-essentials-sbs/ Manually creating a Certificate Request Windows Server 2012] is still the simplest description available and is summarized here below.
+* On Windows the tools for creating a secure web site are fragmented due their original purpose, which was simply to enable certificates on Windows Active Directory Domains. The web page at [https://windowsserveressentials.com/2013/02/06/manually-creating-a-certificate-request-windows-server-essentials-sbs/ Manually creating a Certificate Request Windows Server 2012] is still the simplest description available and is summarized here below.
 #The simplest place to start is on a Windows Server running IIS as the client is only able to create certificates that have been profiled in a Windows AD domain.
 #Under the section on IIS like the link for Server Certificates
-#In the right hand panel select "Create a Certificate Request" - note that this will create a private key if one is not existant
+#In the right-hand panel select "Create a Certificate Request" - note that this will create a private key if one is not existent
 ##The common name will be the web site address. If you use a "*.name.com" here you will be creating a "wild Card" certificate which can cost significantly more.
 ##The rest of the fields should have real values in them, although the Organization unit (OU) has little value for an SSL cert.
-##The next page will allow you to select a key length. While 1024 bits is typically sufficient, it is recommended to chose 2048 bits to make the certificate "future proof".
+##The next page will allow you to select a key length. While 1024 bits is typically sufficient, it is recommended to choose 2048 bits to make the certificate "future proof".
 ##Store the resultant Certificate Request (CSR) as a file with a name which could be something like "example.com.csr".
 ##If you want to check the results of the CSR, open the MMC console, select file-add snap-in and add certificate, click ok and select local machine, then navigate to the "REQUEST" section. Clicking on the certificate and selecting details on the dialog box will give you all of the fields present in the CSR.
 #Go to your favorite SSL [[Certificate Authority]] with the CSR to get a certificate
-#Now that you have an SSL cert, it needs to be installed on the web site together with the private key. This is far more complex than it should be. Just steel yourself for the pain an plunge into it.
+#Now that you have an SSL cert, it needs to be installed on the web site together with the private key. This is far more complex than it should be. Just steel yourself for the pain and plunge into it.
 ##For AWS you must have the command line interface. Here is how to [https://docs.aws.amazon.com/cli/latest/userguide/install-windows.html Install the AWS CLI on Windows]
 ##Here are the instructions on [https://aboutssl.org/install-ssl-certificate-amazon-web-services-aws/ How to Install SSL Certificate on Amazon Web Services (AWS)]. The biggest part of the pain is collecting all of the components in the right format and assembling them into a file in the exact format and specific sequence that AWS requires. AWS tries to con you into using their service to avoid the pain now, but if you ever try to move away from AWS the pain will be even worse.

@@ Line 17: / Line 17: @@
 *The result was an exceeding ugly encoding of everything the CCITT touched, most of which has faded into history, except the X.509 certificate structure and DN naming in [[LDAP]].
 *The security at the time was based on the paradigm at the time - the credit card industry and the card revocation lists, which were updated every few weeks and needed to be checked by every merchant for every transaction.
 ==Solutions==

@@ Line 12: / Line 12: @@
 * A [https://datatracker.ietf.org/doc/html/draft-klasen-ldap-x509certificate-schema-02 draft LDAPv3 Schema for X.509 Certificate] was issued in 2003-03-03.
 * The IETF issued RFC 5280 in 2008-05 for V3 called ''Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile''
 ==Problems==

@@ Line 9: / Line 9: @@
 *The goal was the electronic equivalent of the existing white pages and yellow pages of the ubiquitous telephone directories.
 * The IETF issued RFC 3280 in 2002-04 with definitions of the fields present in the certificate and the certificate revocation lists.
-** and RFC 8379 titled ''Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile''
+** and RFC 3279 titled ''Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile''
 * A [https://datatracker.ietf.org/doc/html/draft-klasen-ldap-x509certificate-schema-02 draft LDAPv3 Schema for X.509 Certificate] was issued in 2003-03-03.
 * The IETF issued RFC 5280 in 2008-05 for V3 called ''Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile''

@@ Line 51: / Line 51: @@
 This uses the [https://blog.cloudflare.com/introducing-cfssl/ Cloudflare app cfssl] for this example of how a json version of the cert used for thrustregisty.org used to be:
 <pre>
 cfssl certinfo -cert cert.pem
+{