Network Security

Digital Certificate Life Cycle and Validation

Nicholas Wong

Jul 9, 2018 — 1 min read

What is certificate

A electronic document with the following info

Who issued the certificate
Who the certificate is issued to
Valid to date (expiry date)
Public key
Digital signature
Hash value of the certificate, used private key to sign the key -> digital signature

To validate, apply public key to digital signature to get back the hash value

X.509 Digital Certification

Certificate trust model

There will be CA , the OS installed the CA certificate, so all certificate signed by that CA will be trusted too

Lifecycle

CA (certificate authority) receives a certificate request
If the request is authorized, the CA issues the certificate
The certificate is delivered to the user, host or service
Application with the PKI (public key infrastructure) uses the certificate correspondingly to its usage and purpose
The certificate expires, or is revoked prior to expiry, then it is impossible to use the certificate
CA receives a request to renew the existing authorized. If it is authorized, the certificate is renewed and can be used again

Validating digital signature

Check digital signature
check if website address is the same as defined on certificate
If people changed the website address on certificate, digital signature won't match

Validating certificates

There are 2 stages

A certificate is correct (trusted) only if it was signed by a trusted CA, and that's why trusted root CA are downloaded first. At this stage the system checks certificates subbmitted bby AIA (Authority Information Access) points and the group poliucy applocan;e for the computer as well as certificate cached earlier
Next System checks the validaity of all cerificates on the path between the trusted CA and the checked certifcate

References

Coming soon

This is Nicholas Workshop, a brand new site by Nicholas Wong that's just getting started. Things will be up and running here shortly, but you can subscribe in the meantime if you'd like to stay up to date and receive emails when new content is published!

Change User To Run Plex On Ubuntu

1. Update etc config /etc/default/plexmediaserver # default script for Plex Media Server # the number of plugins that can run at the same time export PLEX_MEDIA_SERVER_MAX_PLUGIN_PROCS=6 # ulimit -s $PLEX_MEDIA_SERVER_MAX_STACK_SIZE export PLEX_MEDIA_SERVER_MAX_STACK_SIZE=3000 # where the

Back Online

This web site has been down for more than a year and I have not been putting any time to maintain it and put it back online. These days I finally spent some time to make it happen. There is a new theme, new backbone using Ghost and I am

SSH into Your CircleCI Server

1. Generate a set of SSH key pair in your server You would need a public and private of SSH key, theoretically it can be generated in any computer as you like. The following is a sample to generate the key. ssh-keygen -t rsa -b 4096 -C "nicholas@example.