6 Certificates and Public Key Infrastructure Free Online FlashCards

What is a digital certificate?

A digitally signed record that binds an identity or name to a public key.

What does a certificate’s signature let a verifier check?

It lets a verifier check that the certificate was issued by the named issuer and has not been altered.

Does a certificate alone encrypt an HTTPS connection?

No. In HTTPS, the certificate helps authenticate the server; TLS establishes keys to protect the connection.

What does a public key infrastructure (PKI) manage?

PKI is the people, policies, procedures, and technology used to create, issue, manage, validate, and revoke certificates and keys.

How do a certificate authority and registration authority differ?

A CA signs certificates and manages their lifecycle. An RA may handle enrollment or identity checks on the CA’s behalf; the CA remains responsible for issuance.

What happens when a CA issues a certificate?

The applicant generates a key pair and submits a request with a public key and identity; after checks, the CA signs and delivers the certificate. The private key must be protected.

What is the usual order in a certificate chain?

A target certificate may chain through an intermediate CA to a root CA that acts as the trust anchor.

What is a trust anchor?

A trust anchor is a public key and associated information the verifier already accepts; it is the starting point for validation.

Why use an intermediate CA?

It lets an organization issue certificates without routinely using the root CA’s private key. A compromised intermediate can be revoked or removed without necessarily replacing the root.

How do path discovery and path validation differ?

Path discovery finds certificates that may connect the target to a trust anchor; path validation checks whether a proposed path meets the verifier’s requirements.

What are key checks in certificate path validation?

The verifier checks certificate signatures along the path, validity periods, intended use, CA authorization, constraints, and whether critical extensions are understood.

How does a browser check a certificate’s host identity?

For HTTPS, the requested host name must match the certificate’s applicable subject alternative name.