Certificate Request

Full Title

The first step for acquiring a certificate is to create a Certificate Request.

Context

• The Internet runs on Trust which is provided by Certificates which are provided by a Certificate Authority that is trusted by the User Agent which is typically a web Browser.
• Client certificates where the primary reason for the create of the Public Key Infrastructure and the reason for Privacy Enhanced Mail (PEM).

Taxonomy

Risk Appetite the level of uncertainty a company is willing to assume given the corresponding reward associated with the risk. A company with a high-risk appetite would be a company accepting more uncertainty for a higher reward, while a company with a low-risk appetite would seek less uncertainty, for which it would accept a lower return.

Resilience the ability to recover from an unexpected problem.

Time Frame the amount of time for which a risk calculation is made. If the probably of devastating cyber-attack is 1 % per month, that works out to 3 % per quarter, 12% per year (number rounded for simplicity). As it can be seen if an executive needs to get a good quarterly result to earn a bonus, she has little incentive to spend money to reduce risk with a low near-term probability.

Solution

Multiple Signers and the Microsoft IX509CertificateRequestPkcs7 interface

The IX509CertificateRequestPkcs7 interface represents a PKCS #7 certificate message syntax (CMS) object. PKCS #7 defines the format of messages sent to a certification or registration authority to request a public-key certificate. The IX509CertificateRequestPkcs7 interface can be confusing because its implementation does not perfectly mirror the way most security professionals think about the PKCS #7 standard. To avoid this confusion, keep the following points in mind:

• Although a PKCS #7 message is used to wrap a CMC request, an IX509CertificateRequestPkcs7 object cannot contain a IX509CertificateRequestCmc object. Instead, the IX509CertificateRequestCmc interface inherits and implements the IX509CertificateRequestPkcs7 interface. As implemented, a CMC request is therefore a PKCS #7 SignedData object that contains CMC content, a primary signature that is either null-signed or key-based, and zero or more certificate-based signatures. By contrast, a PKCS #7 request is a SignedData object that contains PKCS #10 content (see the next item in this list) and has exactly one certificate-based signature.
• An IX509CertificateRequestPkcs7 must contain an IX509CertificateRequestPkcs10 object. The main advantage of wrapping a PKCS #10 request in a PKCS #7 message is the ability to add multiple signers. The PKCS #10 request is signed by the associated private key, and the PKCS #7 message that wraps the PKCS #10 request is also signed. This second signer uses the certificate being renewed (for a renewal request) or the enrollment agent certificate (for an enroll-on-behalf-of request).
• You can create and enroll a stand-alone IX509CertificateRequestPkcs10 certificate request without wrapping it in an IX509CertificateRequestPkcs7 object.

References

Other Material

• The wiki page on Privacy Risk shares some content with this page as privacy risk is becoming a significant factor in Conduct Risk.
• The wiki page on Privacy Tolerance speaks to a particular area where Conduct Risk can help select an appropriate acceptance level for risk.