3.5.9 Activity: Certificates And Certificate Authorities

Understanding Certificates and Certificate Authorities

In today’s interconnected world, trust is the foundation of secure communication. 5.In practice, whether you are logging into an online bank, sending an encrypted email, or browsing a website that displays the padlock icon, you rely on certificates and certificate authorities to verify identities and protect data. This article walks through the core concepts behind digital certificates, explains the role of certificate authorities (CAs), and provides a detailed guide for completing the 3.9 activity: certificates and certificate authorities—a common lab exercise in networking and cybersecurity courses.

What Is a Digital Certificate?

A digital certificate is an electronic document that binds a public key to an entity’s identity. Think of it as a digital passport: it contains the holder’s name, the public key, the certificate’s validity period, and a digital signature from a trusted third party. On top of that, the most widely used format is X. 509, which defines the fields and encoding rules for certificates.

Key components of an X.509 certificate

When a client receives a certificate, it can verify the signature using the CA’s public key. If the signature checks out and the certificate is within its validity period, the client trusts that the public key truly belongs to the subject named in the certificate.

The Role of Certificate Authorities

A certificate authority (CA) is a trusted organization that issues, renews, and revokes digital certificates. CAs act as neutral third parties whose job is to verify the identity of certificate requestors before signing their public keys. By doing so, they create a chain of trust that enables relying parties (browsers, email clients, VPN gateways, etc.) to accept certificates without having to verify each identity individually.

Types of CAs

1. Root CAs – Self‑signed certificates that sit at the top of the trust hierarchy. Their public keys are pre‑installed in operating systems and browsers.
2. Intermediate CAs – Issued by a root CA to delegate signing responsibilities. They help limit the exposure of the root key.
3. Private CAs – Operated within an organization for internal use (e.g., securing intranet services, code signing, or device authentication).

Trust Models

• Hierarchical Trust Model – A single root CA (or a small set of roots) issues intermediate CAs, which then issue end‑entity certificates. This is the model used by the public web PKI.
• Web of Trust – Used in PGP, where users sign each other’s keys directly; less common in enterprise PKI deployments.

Because the security of the entire PKI hinges on the protection of the CA’s private key, reputable CAs invest heavily in hardware security modules (HSMs), strict operational procedures, and regular audits (e.g., WebTrust, SOC 2).

How Certificates Enable Secure Communication

When a client (e.g., a web browser) connects to a server using TLS, the following steps occur:

1. ServerHello – The server sends its certificate chain (leaf certificate + any intermediates).
2. Certificate Validation – The client verifies each certificate’s signature, checks validity dates, ensures the server’s hostname matches the Subject or SAN, and confirms that the chain leads to a trusted root CA stored in the client’s trust store.
3. Key Exchange – Using the server’s public key (from the certificate), the client and server negotiate a symmetric session key (via RSA key exchange, Diffie‑Hellman, or ECDHE).
4. Encrypted Traffic – All subsequent application data is encrypted with the session key, providing confidentiality and integrity.

If any validation step fails—such as an expired certificate, a hostname mismatch, or an untrusted issuer—the client aborts the connection and displays a security warning.

For more on this topic, read our article on will there be a 4th season of from or check out who's alive from the beatles.

Overview of the 3.5.9 Activity: Certificates and Certificate Authorities The 3.5.9 activity is a hands‑on lab designed to reinforce the theoretical concepts above. Typically, students will:

• Generate a private key and a certificate signing request (CSR) for a test web server.
• Set up a private CA (using OpenSSL or Microsoft Certificate Services).
• Sign the CSR with the private CA to produce a server certificate.
• Configure a web server (e.g., Apache or Nginx) to use the newly issued certificate.
• Verify the TLS handshake from a client browser or command‑line tool (e.g., openssl s_client).
• Experiment with revocation by publishing a Certificate Revocation List (CRL) or using OCSP.

The activity helps learners see the full lifecycle of a certificate: creation, issuance, deployment, validation, and revocation.

Step‑by‑Step Guide to Completing the 3.5.9 Activity

Below is a generic workflow that adapts to most lab environments. Adjust file paths, server names, and commands according to your specific instructions.

1. Prepare the Environment

# Create a working directory
mkdir -p ~/pki-lab/{ca,server,client}
cd ~/pki-lab

2. Build a Private Root CA

# Generate a 2048‑bit RSA private key for the root CA
openssl genpkey -algorithm RSA -out ca/ca.key -pkeyopt rsa_keygen_bits:2048

# Self‑sign the root certificate (valid for 10 years)
openssl req -new -x509 -key ca/ca.key -sha256 -days 3650 \
    -out ca/ca.crt -subj "/C=US/ST=State/L=City/O=MyOrg/OU=IT/CN=MyRootCA"

The root certificate (ca.crt) will later be imported into browsers and clients as a trusted anchor.

3. Create an Intermediate CA (Optional but Recommended)

# Generate intermediate key
openssl genpkey -algorithm RSA -out intermediate/intermediate.key -pkeyopt rsa_keygen_bits:2048

### 3. Create an Intermediate CA (Optional but Recommended)  
```bash
# Generate intermediate key
openssl genpkey -algorithm RSA -out intermediate/intermediate.key -pkeyopt rsa_keygen_bits:2040

# Create CSR for the intermediate CA
openssl req -new -key intermediate/intermediate.key \
    -out intermediate/intermediate.csr \
    -subj "/C=US/ST=State/L=City/O=MyOrg/OU=Intermediate/CN=MyIntermediateCA"

# Sign the intermediate CSR with the root CA
openssl x509 -req -in intermediate/intermediate.csr \
    -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \
    -out intermediate/intermediate.crt -days 1825 -sha256

The intermediate certificate (intermediate.crt) extends trust hierarchy while keeping the root CA offline for security.

4. Generate Server Certificate

# Create server private key
openssl genpkey -algorithm RSA -out server/server.key -pkeyopt rsa_keygen_bits:2048

# Generate CSR with server details
openssl req -new -key server/server.key \
    -out server/server.csr \
    -subj "/C=US/ST=State/L=City/O=MyOrg/CN=server.example.com"

# Sign server CSR with the intermediate CA
openssl x509 -req -in server/server.csr \
    -CA intermediate/intermediate.crt -CAkey intermediate/intermediate.key \
    -CAcreateserial -out server/server.crt -days 365 -sha256

5. Configure Web Server (Nginx Example)

server {
    listen 443 ssl;
    server_name server.example.com;

    ssl_certificate     /path/to/server/server.Think about it: crt;
    ssl_certificate_key /path/to/server/server. key;
    ssl_trusted_certificate /path/to/ca/ca.

    location / {
        root /var/www/html;
    }
}

6. Test TLS Connection

# Verify certificate chain and encryption
openssl s_client -connect server.example.com:443 -showcerts

# Check for revocation status (OCSP)
openssl ocsp -issuer intermediate/intermediate.crt \
    -cert server/server.crt -url http://ocsp.example.com

7. Simulate Revocation

# Generate CRL for intermediate CA
openssl ca -gencrl -keyfile intermediate/intermediate.key \
    -cert intermediate/intermediate.crt \
    -out intermediate.crl -crldays 7

# Publish CRL to a web-accessible location
sudo cp intermediate.crl /var/www/html/crl.crl

Conclusion

The 3.5.9 activity demystifies TLS security by demonstrating the practical lifecycle of digital certificates. From generating private keys to configuring web servers and simulating revocation, participants gain hands-on experience in PKI operations. This foundational knowledge is critical for securing real-world applications, as it highlights the importance of trust validation, key management, and certificate hygiene. By mastering these steps, learners become equipped to troubleshoot TLS issues, implement proper certificate management, and design systems that resist man-in-the-middle attacks. The bottom line: this activity bridges theoretical cryptography with actionable security practices, ensuring that future engineers can build and maintain dependable, encrypted communications.