Jun
18
Overview of Digital Certificates
Filed Under Security Issue | Leave a Comment
Digital certificates use public key cryptography, which is a form of cryptography that uses two keys called a matched keypair. The matched keypair consists of a private key, which is known only to the owner of the keypair, and a public key, which is available to anyone.
The components of the matched keypair are related mathematically so that the encrypted text created using one component of the keypair can be decrypted by using only the other component of the keypair.
You obtain a signed certificate by sending a certificate signing request signed with your private key and containing your public key to a trusted certificate authority, which sends back a signed certificate containing your public key and signed with their private key.
Note: Digital certificates expire after a predetermined period of time. When they expire, HTTPS connection requests to your Web servers are rejected, and certificate-based cXML document authentication fails. You are responsible for renewing your certificates in a timely manner.
Client and Server Certificates
There are two types of digital certificates:
- server certificates, used for SSL, which is required for accepting HTTPS connection requests. These certificates are also called Web server certificates, secure server certificates, and secure server IDs. For more information about HTTP, see “HTTPS Connections” on page 26.
- client certificates, used for “certificate based cXML document authentication.”
For more information about cXML authentication, see “cXML Document Authentication” on page 27.
You can use a single certificate as both a server and a client certificate, depending on the information the certificate authority includes:- If X.509v3 or Netscape extended key usage sections are present, the certificate cannot be used for any purpose not specified by the certificate (for example, server or client).
- If X.509v3 or Netscape extended key usage section are not present, the certificate can be used for any purpose (including server and client).
If you plan to use a single certificate for both SSL and certificate based authentication, ask your certificate authority to issue one that is both a server and a client certificate.
Trusted Certificate Authorities
When you purchase a signed digital certificate, it must refer to an organization that is trusted by Ariba Network. You can use a digital certificate issued by any issuing organization, however it must reference a root certificate from a trusted Certificate Authority. The trusted Certificate Authorities are:
- ABAecom
- AddTrust
- American Express
- ANX Network
- Belgacom
- BelSign
- Deutsche Telekom AG
- Digital Signature Trust Co.
- Entrust
- Equifax
- GlobalSign
- GoDaddy
- GTE CyberTrust
- National Retail Federation
- Thawte
- TrustCenter
- United Parcel Service
- U.S. Department of Defense
- ValiCert
- VeriSign
Encryption Strength
Ariba recommends use of 128-bit encryption or greater.
Common encryption strengths are 40, 56 and 128 bits; The greater the encryption bit width, the stronger the encryption, and the more secure the SSL connection.
Note that “128-bit certificates” are not necessary to support 128-bit encryption. Most “40-bit certificates” support 128-bit encryption or greater. “128-bit certificates” enable server-gated cryptography, which Ariba Network does not use. In most cases, you can use less expensive “40-bit certificates”; consult with your certificate authority about supported encryption strengths.
Domain Name in Server Certificates
The CN (Common Name) field in server certificates for HTTPS must be a fully qualified DNS domain name of a Web server. For example, www.workchairs.com.
You must enter the same name in the transactive URL fields the Configuration area of your Ariba Network account and the name contained in your cXML ProfileResponse. Do not use IP addresses, because you cannot enter IP addresses in your Ariba Network account.
Use a separate certificate for each DNS name that clients will attempt to connect to. Certificate names do not specify Web server ports, so multiple Web server instances on different ports can use the same certificate. However, multiple Web servers cannot share a single certificate.