Cathy’s company, a Certificate Authority (CA), verified Bob’s identity and signed his server certificate with Cathy’s private key. Here’s how it happened:
-
Bob created a pair of asymmetric keys and a certificate that contained his credentials (his name, address, etc.).
Bob’s server certificate was not yet signed by a CA. At this stage it is self-signed using his own private key. Notice that the Issuer and Subject are the same.
-
Bob sent this certificate to Cathy with a request that she verify his identity. (He probably also sent money with his request.) He did not send Cathy his private key.
-
As a CA, Cathy owns a pair of keys and a trusted root certificate.
Cathy’s root certificate is also a self-signed certificate. It serves as the top of the chain of trust. Cathy stores it on a computer that is not on the internet that is kept in a vault.
-
After thoroughly checking Bob’s credentials, Cathy extracted Bob’s public key and metadata from his self-signed certificate and created a new certificate with her name as the Issuer.
Notice how the Issuer and Subject are different from the self-signed certificate that Bob sent Cathy.
-
Cathy then used the private key of her root certificate to sign this new certificate.
-
Cathy compressed both the new server certificate and a copy of her root certificate containing only her public key (Figure 12) with password protection, put both on a website and emailed the links to Bob. The public key part doesn’t have to be protected and can be emailed.
-
Then she phoned Bob and gave him the password for the two compressed, password-protected files.
-
Bob expanded the files and imported his signed server certificate into the Key Store on his JACE. This action replaced his self-signed certificate. The imported certificate must match the certificate that created the CSR in the first place.
-
Finally, Cathy’s root certificate needs to be installed in Alice’s Trust Store. There are several ways for Alice to install Cathy’s root certificate in her Trust Store:
-
If Cathy is a well-known CA, her root certificate may have been installed when Alice installed her browser.
-
Since Alice is a customer of Bob’s, he may have created an installation program, which Alice can download and install in her browser.
-
If Alice is a JACE controller, Bob may install Cathy’s root certificate in the office, when he sets up each JACE before taking them out to the field. Or he may put Cathy’s root certificate on a thumb drive and take it to the JACE for installation.
-
The root certificate with its public key is a public certificate that can be emailed.