Instructor: Certificate management. 2 2
In this lesson, 3 3
we're going to talk all about certificate management, 4 4
which has to do with digital certificates. 5 5
When you deal with certificate management, 6 6
this is the practice of issuing, updating, 7 7
and revoking digital certificates. 8 8
Now, in this lesson, 9 9
we're not going to go and review everything we talked about 10 10
back in Security+. 11 11
You should already understand how PKI works 12 12
and digital certificates in general. 13 13
Instead, we're going to focus on what you need to know 14 14
for the CySA+ exam. 15 15
Now, the principle means 16 16
of assuring the identity of machines and application code 17 17
is to use digital certificates. 18 18
That's why they're so important. 19 19
We talk a lot about digital certificates in this course 20 20
in their various uses. 21 21
Now, when you're dealing with a digital certificate, 22 22
one of the ways to check it 23 23
is by using third party utilities. 24 24
You can do this using something like sigcheck, 25 25
which is a Sysinternals utility 26 26
that allows you to verify root certificates 27 27
in the local store against Microsoft's master trust list. 28 28
This will make sure that your operating system certificates 29 29
are actually trusted, 30 30
and they are the ones that Microsoft signed. 31 31
Now, another way you can do this is by using OpenSSL. 32 32
Now, OpenSSL is a library of software functions 33 33
that support SSL and TLS protocols. 34 34
Now, because of that, 35 35
OpenSSL has a large amount of commands 36 36
that are there for you to be able to create 37 37
and view digital certificates, generate private keys, 38 38
and even test the SSL and TLS functions. 39 39
In addition to this, 40 40
you can use third party OpenSSL binaries for Windows, 41 41
but if you're already running Windows, 42 42
there's already a built-in tool for this. 43 43
It's known as certutil. 44 44
This is a Windows utility 45 45
that allows you to display certification authority 46 46
or CA configuration information. 47 47
It'll allow you to configure certificate services, 48 48
backup and restore CA components, and verify certificates, 49 49
key pairs, and certificate chains, 50 50
and all of this uses parts of OpenSSL to do it. 51 51
Now, when we start talking about certificate management, 52 52
there are lots of different tasks that we're going to do. 53 53
For example, with certificate management 54 54
we're going to install, update, 55 55
and validate trusted root certificates. 56 56
Root certificates are the top of the tree, 57 57
and so we have to know what that root is 58 58
for everything else below it to be trusted. 59 59
So if somebody has compromised a root certificate, 60 60
that's a big deal, and if they did, 61 61
we would need to install a new one, 62 62
and so that's an important function here. 63 63
Another thing we're concerned with is deploying, 64 64
updating, and revoking subject certificates. 65 65
Now, I talk about a subject certificate. 66 66
This can be a user certificate, 67 67
like a digital email certificate 68 68
that I might use to sign my emails, 69 69
or it can be a machine certificate assigned to my laptop 70 70
and used as part of my RADIUS server 71 71
as I'm trying to log on using 802.1X, if I'm using that, 72 72
using digital certificates. 73 73
All of these can be deployed, updated, 74 74
and revoked using the certificate management tools 75 75
that we're talking about in this lesson. 76 76
Another thing we can do is prevent the use 77 77
of self-signed certificates. 78 78
By doing proper certificate management, 79 79
we can say no self-signed certificates are allowed, 80 80
only ones signed by our root CA, 81 81
and that would make sure that we are getting things we trust 82 82
and not allowing self-signed. 83 83
Now, why do we want to prevent the use 84 84
of self-signed certificates? 85 85
Well, because a lot of malware code 86 86
will actually sign itself, 87 87
so that way you see a digital certificate and go, 88 88
"Ah, this must be something I can trust," 89 89
and you'll install it anyway. 90 90
Or people will create an SSL self-signed certificate 91 91
and put it on their web server, 92 92
and then they'll use that 93 93
as a way to do a man-in-the-middle attack, 94 94
so from you to the web server to your final destination. 95 95
And they sit in between, 96 96
collecting all that information as a proxy. 97 97
Or people might create a self-signed SSL or TLS certificate 98 98
and they'll use that as a way to be a man in the middle. 99 99
So you'll connect to them, you'll see that digital signature 100 100
and think everything's good, 101 101
and then you'll go right through 102 102
from them to your final destination, 103 103
and they'll be sitting in the middle 104 104
collecting your information the entire time. 105 105
Another thing we want to focus on is SSH key management. 106 106
If you're dealing with SSH, most of the time, 107 107
you're going to be using cryptographic key pairs 108 108
to be able to do the log on and off authentication. 109 109
Well, that all has to be managed, 110 110
and that's what certificate management does. 111 111
It manages all those key pairs 112 112
and all those digital certificates 113 113
that are being used as part of SSH.