The Certificate Authority and the Operation and Revocation of Certificates
頻出~29 min4 terms10 past questions
Goals of this unit
Explain what a CA (Certificate Authority) vouches for with a digital certificate, and why a third party separate from the communicating parties takes on that role.
Walk through, in order, how a certificate goes from application to being checked by the recipient.
Tell a certificate listed on a CRL (Certificate Revocation List) apart from one whose validity period has simply run out.
A CA (Certificate Authority) is a body that issues digital certificates binding a public key to its owner, and vouches for their contents with its own signature.
Apply: submit public key and identity
Review: CA confirms identity
Issue: certificate signed by the CA
Verify: recipient checks the CA's signature
Whoever receives the certificate verifies the CA's signature and so confirms who owns the public key.
4 / 4
A public key on its own tells the recipient nothing about whether it really belongs to the person who claims it. So the CA first checks the applicant's identity, then creates a digital signature over the public key and owner details with its own private key and hands them over as a digital certificate. By verifying the CA's signature, the recipient can confirm that the key's owner is who they claim to be.
AnalogyIt is like registering an official seal at a government office: the office checks who you are and then certifies that this registered mark (the public key) really is yours. A neutral third party (the CA) does the same for keys.
How to rememberC is for Certificate, A is for Authority. Read it as "the authority over certificates" and it is clear this is the side that hands them out.
Exam points
ExamWhat a CA vouches for in a certificate is that the public key belongs to the person who claims it. Besides issuing certificates, a CA also revokes them.
ExamThanks to the CA's guarantee, the recipient can confirm that the sender is the public key's real owner and see through spoofing (なりすまし), where someone poses as another person. The CA does not watch for changes to the content.
Mix-upA CA does not encrypt (暗号化) or decrypt on anyone's behalf. The parties themselves encrypt with their keys; the CA vouches that those keys are genuine.
The Japanese term 認証局 (certificate authority) is what Japanese materials call a CA: a body that issues digital certificates as a third party with no stake in the communication or transaction.
PKI (Public Key Infrastructure) is the whole system in which certificates show which public key belongs to whom, and a trusted body stands behind those certificates. The certificate authority sits at the center of this system, so by trusting it, users can trust the public key of someone they have never met. If the authority's signature checks out, it also shows the certificate was not swapped along the way.
AnalogyA passport works abroad because other countries trust the government that issued it. A certificate authority likewise gives a certificate its weight by being an issuer the other side trusts.
How to rememberIn the Japanese name, 認証 means confirming someone is who they say, and 局 is the character for a bureau or office: literally, "the bureau that confirms identity."
Exam points
ExamA certificate authority (認証局) issues certificates for a party's public key (公開鍵). The private key stays with its owner and is never handed out, so no certificate covers it.
ExamA certificate authority (認証局) is an indispensable part of PKI. Within PKI, without an authority behind the certificates, there would be no way to confirm who owns a public key.
ExamIf a signed email uses a certificate the sender made themselves instead of one from a trusted certificate authority (認証局), the recipient cannot confirm that the email really came from that sender.
A CRL (Certificate Revocation List) is a list the CA publishes of digital certificates that were invalidated (revoked) partway through, while still within their validity period.
Incident: private key leaked, etc.
Request: owner contacts the CA
List: CA adds it to the CRL and publishes
Check: recipient looks up the CRL
Whoever receives the certificate checks the CRL and does not trust the certificate if it appears there.
4 / 4
Certificates have a validity period and simply stop working once it ends. Separately, if the private key leaks or the owner changes organizations, the certificate must be cancelled even before that period is up. So a recipient checks not only that a certificate is within its validity period but also that it is not on the CRL.
AnalogyIt is like a list of blocked credit card numbers sent out to shops. Even if a card has not expired, a number on the list is refused.
How to rememberRevocation means taking back. Read it as a List of certificates taken back early, not ones that simply expired.
Exam points
ExamA CRL lists certificates revoked while still within their validity period. A certificate whose period has merely ended is not listed.
Mix-upA CRL is not a body that issues certificates but a list that a CA compiles and publishes. CA names the body; CRL names the table of withdrawn certificates.
The Japanese term 証明書失効リスト (certificate revocation list) is the Japanese name for a CRL: the list of certificates invalidated partway through their validity period.
The CA compiles this list, signs it, and updates and publishes it at regular intervals. A recipient holding an old copy would miss recent revocations, so they fetch the latest version before checking.
AnalogyIt is like posting the numbers of reported-lost staff badges at the front desk. The desk compares each visitor's badge against the list before letting them in.
How to rememberThe Japanese 失効 is written "lose effect", which uses different characters from 満了, "run to term"; the characters themselves tell revocation and expiry apart.
Exam points
ExamWhen a private key leaks, the CA adds the certificate to the certificate revocation list (証明書失効リスト) at the owner's request and so invalidates it. There is no need to wait until the certificate comes up for renewal.
Mix-upThe Japanese term 証明書失効リスト (certificate revocation list) and CRL are the Japanese and English names for the same thing; there are not two separate lists.