1 1 00:00:00,360 --> 00:00:02,430 Certificate management. 2 2 00:00:02,430 --> 00:00:03,300 In this lesson, 3 3 00:00:03,300 --> 00:00:05,880 we're going to talk all about certificate management, 4 4 00:00:05,880 --> 00:00:08,220 which has to do with digital certificates. 5 5 00:00:08,220 --> 00:00:09,690 When you deal with certificate management, 6 6 00:00:09,690 --> 00:00:11,820 this is the practice of issuing, updating, 7 7 00:00:11,820 --> 00:00:13,950 and revoking digital certificates. 8 8 00:00:13,950 --> 00:00:15,030 Now, in this lesson, 9 9 00:00:15,030 --> 00:00:17,250 we're not going to go and review everything we talked about 10 10 00:00:17,250 --> 00:00:18,690 back in Security+. 11 11 00:00:18,690 --> 00:00:20,760 You should already understand how PKI works 12 12 00:00:20,760 --> 00:00:22,800 and digital certificates in general. 13 13 00:00:22,800 --> 00:00:24,900 Instead, we're going to focus on what you need to know 14 14 00:00:24,900 --> 00:00:26,730 for the CySA+ exam. 15 15 00:00:26,730 --> 00:00:27,840 Now, the principle means 16 16 00:00:27,840 --> 00:00:30,480 of assuring the identity of machines and application code 17 17 00:00:30,480 --> 00:00:32,280 is to use digital certificates. 18 18 00:00:32,280 --> 00:00:34,080 That's why they're so important. 19 19 00:00:34,080 --> 00:00:36,690 We talk a lot about digital certificates in this course 20 20 00:00:36,690 --> 00:00:38,460 in their various uses. 21 21 00:00:38,460 --> 00:00:40,440 Now, when you're dealing with a digital certificate, 22 22 00:00:40,440 --> 00:00:41,730 one of the ways to check it 23 23 00:00:41,730 --> 00:00:44,190 is by using third party utilities. 24 24 00:00:44,190 --> 00:00:46,560 You can do this using something like sigcheck, 25 25 00:00:46,560 --> 00:00:48,360 which is a Sysinternals utility 26 26 00:00:48,360 --> 00:00:50,190 that allows you to verify root certificates 27 27 00:00:50,190 --> 00:00:53,640 in the local store against Microsoft's master trust list. 28 28 00:00:53,640 --> 00:00:55,950 This will make sure that your operating system certificates 29 29 00:00:55,950 --> 00:00:57,480 are actually trusted, 30 30 00:00:57,480 --> 00:00:59,790 and they are the ones that Microsoft signed. 31 31 00:00:59,790 --> 00:01:02,440 Now, another way you can do this is by using OpenSSL. 32 32 00:01:03,420 --> 00:01:06,000 Now, OpenSSL is a library of software functions 33 33 00:01:06,000 --> 00:01:08,970 that support SSL and TLS protocols. 34 34 00:01:08,970 --> 00:01:10,170 Now, because of that, 35 35 00:01:10,170 --> 00:01:12,840 OpenSSL has a large amount of commands 36 36 00:01:12,840 --> 00:01:14,430 that are there for you to be able to create 37 37 00:01:14,430 --> 00:01:17,400 and view digital certificates, generate private keys, 38 38 00:01:17,400 --> 00:01:20,610 and even test the SSL and TLS functions. 39 39 00:01:20,610 --> 00:01:21,720 In addition to this, 40 40 00:01:21,720 --> 00:01:24,870 you can use third party OpenSSL binaries for Windows, 41 41 00:01:24,870 --> 00:01:26,610 but if you're already running Windows, 42 42 00:01:26,610 --> 00:01:28,500 there's already a built-in tool for this. 43 43 00:01:28,500 --> 00:01:30,120 It's known as certutil. 44 44 00:01:30,120 --> 00:01:31,350 This is a Windows utility 45 45 00:01:31,350 --> 00:01:33,630 that allows you to display certification authority 46 46 00:01:33,630 --> 00:01:35,610 or CA configuration information. 47 47 00:01:35,610 --> 00:01:37,890 It'll allow you to configure certificate services, 48 48 00:01:37,890 --> 00:01:41,130 backup and restore CA components, and verify certificates, 49 49 00:01:41,130 --> 00:01:43,140 key pairs, and certificate chains, 50 50 00:01:43,140 --> 00:01:46,620 and all of this uses parts of OpenSSL to do it. 51 51 00:01:46,620 --> 00:01:48,840 Now, when we start talking about certificate management, 52 52 00:01:48,840 --> 00:01:51,120 there are lots of different tasks that we're going to do. 53 53 00:01:51,120 --> 00:01:53,160 For example, with certificate management 54 54 00:01:53,160 --> 00:01:54,540 we're going to install, update, 55 55 00:01:54,540 --> 00:01:56,880 and validate trusted root certificates. 56 56 00:01:56,880 --> 00:01:59,880 Root certificates are the top of the tree, 57 57 00:01:59,880 --> 00:02:01,890 and so we have to know what that root is 58 58 00:02:01,890 --> 00:02:03,750 for everything else below it to be trusted. 59 59 00:02:03,750 --> 00:02:06,000 So if somebody has compromised a root certificate, 60 60 00:02:06,000 --> 00:02:08,010 that's a big deal, and if they did, 61 61 00:02:08,010 --> 00:02:09,570 we would need to install a new one, 62 62 00:02:09,570 --> 00:02:11,370 and so that's an important function here. 63 63 00:02:11,370 --> 00:02:13,560 Another thing we're concerned with is deploying, 64 64 00:02:13,560 --> 00:02:15,960 updating, and revoking subject certificates. 65 65 00:02:15,960 --> 00:02:17,490 Now, I talk about a subject certificate. 66 66 00:02:17,490 --> 00:02:19,020 This can be a user certificate, 67 67 00:02:19,020 --> 00:02:20,640 like a digital email certificate 68 68 00:02:20,640 --> 00:02:22,530 that I might use to sign my emails, 69 69 00:02:22,530 --> 00:02:26,040 or it can be a machine certificate assigned to my laptop 70 70 00:02:26,040 --> 00:02:27,780 and used as part of my RADIUS server 71 71 00:02:27,780 --> 00:02:31,020 as I'm trying to log on using 802.1X, if I'm using that, 72 72 00:02:31,020 --> 00:02:32,670 using digital certificates. 73 73 00:02:32,670 --> 00:02:34,290 All of these can be deployed, updated, 74 74 00:02:34,290 --> 00:02:36,870 and revoked using the certificate management tools 75 75 00:02:36,870 --> 00:02:38,700 that we're talking about in this lesson. 76 76 00:02:38,700 --> 00:02:40,530 Another thing we can do is prevent the use 77 77 00:02:40,530 --> 00:02:42,270 of self-signed certificates. 78 78 00:02:42,270 --> 00:02:43,980 By doing proper certificate management, 79 79 00:02:43,980 --> 00:02:46,980 we can say no self-signed certificates are allowed, 80 80 00:02:46,980 --> 00:02:49,260 only ones signed by our root CA, 81 81 00:02:49,260 --> 00:02:51,060 and that would make sure that we are getting things we trust 82 82 00:02:51,060 --> 00:02:52,710 and not allowing self-signed. 83 83 00:02:52,710 --> 00:02:54,210 Now, why do we want to prevent the use 84 84 00:02:54,210 --> 00:02:55,650 of self-signed certificates? 85 85 00:02:55,650 --> 00:02:57,270 Well, because a lot of malware code 86 86 00:02:57,270 --> 00:02:58,440 will actually sign itself, 87 87 00:02:58,440 --> 00:03:00,127 so that way you see a digital certificate and go, 88 88 00:03:00,127 --> 00:03:01,860 "Ah, this must be something I can trust," 89 89 00:03:01,860 --> 00:03:03,390 and you'll install it anyway. 90 90 00:03:03,390 --> 00:03:06,450 Or people will create an SSL self-signed certificate 91 91 00:03:06,450 --> 00:03:07,920 and put it on their web server, 92 92 00:03:07,920 --> 00:03:08,753 and then they'll use that 93 93 00:03:08,753 --> 00:03:10,260 as a way to do a man-in-the-middle attack, 94 94 00:03:10,260 --> 00:03:13,080 so from you to the web server to your final destination. 95 95 00:03:13,080 --> 00:03:14,220 And they sit in between, 96 96 00:03:14,220 --> 00:03:16,290 collecting all that information as a proxy. 97 97 00:03:16,290 --> 00:03:20,250 Or people might create a self-signed SSL or TLS certificate 98 98 00:03:20,250 --> 00:03:22,410 and they'll use that as a way to be a man in the middle. 99 99 00:03:22,410 --> 00:03:24,930 So you'll connect to them, you'll see that digital signature 100 100 00:03:24,930 --> 00:03:26,370 and think everything's good, 101 101 00:03:26,370 --> 00:03:27,300 and then you'll go right through 102 102 00:03:27,300 --> 00:03:29,010 from them to your final destination, 103 103 00:03:29,010 --> 00:03:30,000 and they'll be sitting in the middle 104 104 00:03:30,000 --> 00:03:32,550 collecting your information the entire time. 105 105 00:03:32,550 --> 00:03:35,730 Another thing we want to focus on is SSH key management. 106 106 00:03:35,730 --> 00:03:38,010 If you're dealing with SSH, most of the time, 107 107 00:03:38,010 --> 00:03:39,840 you're going to be using cryptographic key pairs 108 108 00:03:39,840 --> 00:03:42,240 to be able to do the log on and off authentication. 109 109 00:03:42,240 --> 00:03:44,730 Well, that all has to be managed, 110 110 00:03:44,730 --> 00:03:46,350 and that's what certificate management does. 111 111 00:03:46,350 --> 00:03:48,000 It manages all those key pairs 112 112 00:03:48,000 --> 00:03:49,620 and all those digital certificates 113 113 00:03:49,620 --> 00:03:51,453 that are being used as part of SSH.