Digital certificate

There are still some deficiencies in the message security regime described previously. How do we know that people and institutions are who they claim to be? Anyone can make up a private and public key combination and claim to be someone they are not. Before you place an order with an online merchant such as Amazon, you want to be sure it really is Amazon you have on the screen and not a spoofer masquerading as Amazon. Digital certificates, and the supporting public key infrastructure, are an attempt to solve this problem of digital identity.

A digital certificate is a digital document issued by a trusted third-party institution known as a certification authority (CA) that contains the name of the subject or company, the subject's public key, a digital certificate serial number, an expiration date, an issuance date, the digital signature of the certification authority (the name of the CA encrypted using the CA's private key), and other identifying information.

In the United States, private corporations such as VeriSign, browser manufacturers, security firms, and government agencies such as the U.S. Postal Service and the Federal Reserve issue CAs. Worldwide, thousands of organizations issue CAs. A hierarchy of CAs has emerged with less-well-known CAs being certified by larger and better-known CAs, creating a community of mutually verifying institutions. Public key infrastructure (PKI) refers to the CAs and digital certificate procedures that are accepted by all parties.

To create a digital certificate, the user generates a public/private key pair and sends a request for certification to a CA along with the user's public key. The CA verifies the information and issues a certificate containing the user's public key and other related information. Finally, the CA creates a message digest from the certificate itself (just like a hash digest) and signs it with the CA's private key — this signed digest is the signed certificate, a totally unique cipher text document. When you sign into a 'secure' site, the URL will begin with 'https' and a closed lock icon will appear on your browser, meaning the site has a digital certificate issued by a trusted CA.