Information Technology Reference
In-Depth Information
Role-based administration limits the PKI tasks a domain administrator account can per-
form. Four key roles must be filled to administer a CA and its components: CA
Administrator, Certificate Manager, Backup Operator, and Auditor.
■
When a full backup or system state backup is performed on a CA server, the certificate
store is backed up along with other data. You use the Active Directory Certificate Services
snap-in to back up the certificate database and database log.
■
When users' private keys are lost or damaged, they could lose access to systems or docu-
ments. Keys can be archived manually with the Certificates snap-in or automatically on
enterprise CAs by assigning users as key recovery agents.
■
CA Web proxy
A server configured with the Web Enrollment role service.
See also
registration authority.
certificate practice statement (CPS)
A document describing how a CA issues certificates
containing the CA identity, security practices used to maintain CA integrity, types of
certificates issued, renewal policy, and so forth.
certificate templates
A shell or model of a certificate used to create new certificates; it
defines characteristics of the certificate, such as the intended use and expiration date.
hash algorithm
A mathematical function that takes a string of data as input and produces
a fixed-size value as output. Hash values are used to verify that the original data hasn't been
changed and to sign CA certificates and certificates issued by the CA.
intermediate CAs
A CA in a multilevel CA hierarchy that issue certificates to issuing CAs,
which respond to user and device certificate requests. Sometimes called a policy CA.
issuing CAs
11
A CA that interacts with clients to field certificate requests and maintain the
CRL.
key archival
A method of backing up private keys and restoring them if users' private keys
are lost.
Network Device Enrollment Service (NDES)
A service that allows network devices, such as
routers and switches, to obtain certificates by using Simple Certificate Enrollment Protocol
(SCEP), a Cisco proprietary protocol.
online responder (OR)
A role service that enables clients to check a certificate's revocation
status without having to download the CRL.
public key infrastructure (PKI)
A security system that binds a user's or device's identity to
a cryptographic key that secures data transfer with encryption and ensures data authenticity
with digital certificates.
registration authority
A server configured with the Web Enrollment role service.
See also
CA
Web proxy.
restricted enrollment agent
An enrollment agent that's limited to enrolling only specific
users or security groups. Restricted enrollment agents are available only with an enterprise CA.
root CA
The first CA installed in a network. Clients are configured to trust the root CA's
certificate, and then implicitly trust the certificate of any CA that's subordinate to the root.
Which of the following is a service provided by a PKI? (Choose all that apply.)
a.
Confidentiality
b.
Nonrepudiation
c.
Authorization
d.
Antivirus
Search WWH ::
Custom Search