Certificate Management

A digital certificate binds an identity to a public key. A certification authority signs that binding. A relying party can then validate who issued the certificate, when it is valid, what it may be used for, and whether the identity matches the connection.

Certificates appear in public websites, private services, user and device authentication, code signing, email, and document signing. This course focuses on the management skill shared by those uses. You need to know what exists, who owns it, how trust is established, when renewal is due, how deployment works, and what to do when trust must end early.

Certificate management is not the same as cryptographic key management. The certificate is normally public. Its corresponding private key is secret. You manage them together because a valid certificate with an exposed private key is unsafe, while a protected private key with an expired certificate is unusable.

The certificate trust model

Think of a certificate as a signed identity record, not as trust by itself.

A typical chain contains an end-entity certificate, one or more intermediate certification authority certificates, and a root certificate. The relying party starts with a root it already trusts. It validates signatures and constraints from the end-entity certificate toward that trust anchor.

For a TLS server, successful validation also depends on the requested name matching an identity in the certificate. A valid signature for the wrong name does not authenticate the server you intended to reach.

Certificate Management

The certificate trust model

Relevant careers