Digital certificate creation overview

 

+

Search Tips   |   Advanced Search

 

Use digital certificates to run tests against applications that require client-side digital certificates to authenticate users, work with the appropriate server administrators to determine the types of certificates that you need to create.

In cryptography, a public key certificate is a document that uses a digital signature to bind a public key with a physical identity. These certificates are often referred to generically as digital certificates or client digital certificates. The most common standard for digital certificates is the X.509 standard.

In public key cryptography, each certificate has two associated keys:

  1. public key
  2. private key

The public key is incorporated into the X.509 certificate and is always available with the certificate itself. The private key is always kept private (meaning, it is never transmitted). For ease of portability, the two keys (and the certificate) can be included in one, encrypted and passphrase-protected, format known as PKCS#12.

In order to verify the authenticity of a certificate, it is digitally signed by another certificate, known as a Certificate Authority (CA). This CA certificate may be one created (and kept secure) by a company hosting a secure application, or it could be created by a company such as Verisign.

When a Web application requires digital certificates, an administrator typically creates digital certificates for each authorized user. The administrator digitally signs each certificate using the system CA certificate. These certificates, along with the public and private keys, are distributed to users. Often these keys will be distributed in the PKCS#12 format. Users then import these certificates into their Web browsers. When the browser is challenged by the server, it will produce its certificate.

When importing certificates for Web applications, select the check box that indicates that the keys be exportable. With this indication, the certificate can be exported to a PKCS#12 formatted file for later use by other programs.

Do not use certificates that are assigned to actual users for performance testing purposes. Use test certificates that do not correspond to actual users.

There are four types of certificates that can be used in testing:

Self-signed certificates are used when no entity needs to vouch for the authenticity of the certificate. These are the simplest certificates to create and use. Typically, however, a signed certificate is used to represent a particular user.

Signed certificates are used when a certificate needs to be created for and issued to one, and only one, user. Signed certificates are signed by a CA.

CA certificates are self-signed certificates used to sign (certify) certificates.

Unsigned certificates are certificates that are neither signed by a CA nor self-signed. Most Web applications do not use unsigned certificates.

When creating a self-signed or signed certificate (including CA certificates) you can specify a subject. The subject of a certificate is the set of attributes of an X.500 Distinguished Name that is encoded in the certificate. The subject enables the recipient of a certificate to see information about the owner of the certificate. The subject describes the certificate owner, but is not necessarily unique. Think of subjects as entries in a telephone book; there can be multiple entries for Lois Lane, but each entry refers to a different person.

The subject can contain many different types of identifying data. Typically, the subject includes the following:

Attribute Example
COMMON NAME (CN) CN=Lois Lane
ORGANIZATION (O) O=IBM
ORGANIZATIONAL UNIT (OU) OU=IBM
COUNTRY (C) C=US
LOCALITY (L) L=NYC
STATE or PROVINCE (ST) ST=NY
E-MAIL ADDRESS (emailAddress) emailAddress=llane@ibm.com

This information can be typed as one string, using forward slashes to separate the data.

For example, the above subject would be typed as follows:

To learn more about using the supplied command-line program to create certificates, see Create a digital certificate store.


Related

  • Entrust TruePass authentication overview
  • Create a digital certificate with OpenSSL
  • Create a digital certificate store
  • Record a test with digital certificates
  • Play back a test with a digital certificate