Mostimportantly, a certicate binds the owner's public key to the owner's identity. Like a
passportbinds a photograph to personal information about its holder, a certicate binds a
publickey to information about its owner.
Inaddition to the public key, a certicate typically includes information such as:
■Thename of the holder and other identication, such as the URL of the Web server using
thecerticate, or an individual's email address.
■Thename of the CA that issued the certicate.
■Anexpiration date.
DigitalCerticates are governed by the technical specications of the X.509 format. To verify
theidentity of a user in the certificate realm, the authentication service veries an X.509
certicate,using the common name eld of the X.509 certicate as the principal name.

AboutCerticate Chains

Webbrowsers are precongured with a set of root CA certicates that the browser
automaticallytrusts. Any certicates from elsewhere must come with a certicate chain to verify
theirvalidity. A certicate chain is series of certicates issued by successive CA certicates,
eventuallyending in a root CA certicate.
Whena certicate is rst generated, it is a self-signed certicate. A self-signed certicate is one
forwhich the issuer (signer) is the same as the subject (the entity whose public key is being
authenticatedby the certicate). When the owner sends a certicate signing request (CSR) to a
CA,then imports the response, the self-signed certicate is replaced by a chain of certicates. At
thebottom of the chain is the certicate (reply) issued by the CA authenticating the subject's
publickey. The next certicate in the chain is one that authenticates the CA's public key.
Usually,this is a self-signed certicate (that is, a certicate from the CA authenticating its own
publickey) and the last certicate in the chain.
Inother cases, the CA can return a chain of certicates. In this case, the bottom certicate in the
chainis the same (a certicate signed by the CA, authenticating the public key of the key entry),
butthe second certicate in the chain is a certicate signed by a dierent CA, authenticating the
publickey of the CA to which you sent the CSR. Then, the next certicate in the chain is a
certicateauthenticating the second CA's key, and so on, until a self-signed root certicate is
reached.Each certicate in the chain (after the rst) thus authenticates the public key of the
signerof the previous certicate in the chain.
About Secure SocketsLayer
SecureSockets Layer (SSL) is the most popular standard for securing Internet communications
andtransactions. Web applications use HTTPS (HTTP over SSL), which uses digital certicates
toensure secure, condential communications between server and clients. In an SSL
connection,both the client and the server encrypt data before sending it, then decrypt it upon
receipt.
IntroductiontoCer ticatesand SSL
Chapter9 • Conguring Security 109