1
00:00:00,000 --> 00:00:10,680
In this lesson I want to explain certificate services.

2
00:00:10,680 --> 00:00:16,799
So PKI is the keyword, it stands for the public key infrastructure, and it is about the infrastructure

3
00:00:16,799 --> 00:00:22,680
that provides public private keys that can be used to secure services.

4
00:00:22,680 --> 00:00:28,559
Now in this case the private key is what is supposed to be private, and it is used by

5
00:00:28,559 --> 00:00:34,919
a server to prove its identity, and the public key is handed out to clients for secure communication.

6
00:00:34,919 --> 00:00:40,320
The client uses the public key, and that allows you to send encrypted traffic which next can

7
00:00:40,320 --> 00:00:44,520
be decrypted with the private key on the server.

8
00:00:44,520 --> 00:00:49,520
To guarantee the authenticity of a public private key pair the keys need to be signed,

9
00:00:49,520 --> 00:00:56,119
and the signing is happening by an external certificate authority, or the CA.

10
00:00:56,119 --> 00:01:00,680
You can also use self-signed certificates, and self-signed certificates are keys that

11
00:01:00,680 --> 00:01:06,519
are not signed by a commonly known certificate authority, but by an internal CA that is not

12
00:01:06,519 --> 00:01:08,680
commonly trusted.

13
00:01:08,680 --> 00:01:14,120
Now that sounds as if it doesn't make sense, it does, because if you are working with certificates

14
00:01:14,120 --> 00:01:19,599
on your own site, why would you pay an external certificate authority for the reliability

15
00:01:19,599 --> 00:01:21,160
of your certificates?

16
00:01:21,160 --> 00:01:26,320
But for your own clients only, you can take care of this reliability internally.

17
00:01:26,320 --> 00:01:32,040
So self-signed certificates are quite common, but be aware that if ever your browser encounters

18
00:01:32,040 --> 00:01:35,320
self-signed certificates, it will issue a warning.

19
00:01:35,320 --> 00:01:39,320
It's very likely that you have already seen warnings like this while browsing the internet

20
00:01:39,320 --> 00:01:43,480
to unreliable web servers.

21
00:01:43,480 --> 00:01:45,800
So how do we use certificates?

22
00:01:45,800 --> 00:01:52,160
Well, a message digest is a fixed-size numerical representation of the contents of a message.

23
00:01:52,160 --> 00:01:56,720
And this message digest is calculated by a hash function.

24
00:01:56,720 --> 00:02:02,120
And in secure communication, the sender typically generates a message digest, which is encrypted

25
00:02:02,120 --> 00:02:06,559
with the private key of an asymmetric key pair.

26
00:02:06,559 --> 00:02:11,800
Asymmetric key pair, that means that the sender and receiver are not using the same key.

27
00:02:11,800 --> 00:02:18,880
So the sender generates the message with the private key, and the result is a digital signature.

28
00:02:18,880 --> 00:02:24,399
And next, the signature is decrypted by the receiver to verify the identity of the sender.

29
00:02:24,399 --> 00:02:28,160
And next, an encrypted channel has been established.

30
00:02:28,160 --> 00:02:30,440
Let me show you how this works.

31
00:02:30,440 --> 00:02:35,160
So let me give you an overview of how TLS certificates are used.

32
00:02:35,160 --> 00:02:41,039
Let's say we have a client and we have a web server.

33
00:02:41,039 --> 00:02:43,960
And I'm going for a simplified overview here.

34
00:02:43,960 --> 00:02:48,960
Now, when you are going to send your sensitive data to the web server, you want to make sure

35
00:02:48,960 --> 00:02:53,399
that the transport is secured.

36
00:02:53,399 --> 00:02:54,679
So how does that work?

37
00:02:54,679 --> 00:02:58,279
Well, the web server has a private key.

38
00:02:58,279 --> 00:03:07,199
And when you initialize traffic with the web server, you are going to make sure that you get the web server public key.

39
00:03:07,199 --> 00:03:10,960
The public key is mathematically related to the private key.

40
00:03:10,960 --> 00:03:12,880
So they belong together.

41
00:03:12,880 --> 00:03:18,039
But the first question is, how are you going to be sure that this public key is legit?

42
00:03:18,039 --> 00:03:21,520
Well, that is because of the certificate authority, the CA.

43
00:03:21,520 --> 00:03:27,759
And the certificate authority has signed this public key in the PKI certificate.

44
00:03:27,759 --> 00:03:32,639
And in case you want to know how the certificate authority has done that, well, that is easy,

45
00:03:32,639 --> 00:03:34,759
with their own public-private key.

46
00:03:34,759 --> 00:03:42,119
So the public key has been signed with, let's call it CAPR, the certificate authority private key.

47
00:03:42,119 --> 00:03:48,399
And because certificate authorities are supposed to be well-known, when you receive this signed public key,

48
00:03:48,399 --> 00:03:53,240
because of the fact that the certificate authority is known, you can check that it is legit.

49
00:03:53,240 --> 00:03:59,960
Because browsers and such have the certificate authority public key on board and they can verify that it's okay.

50
00:03:59,960 --> 00:04:02,119
So you can trust it.

51
00:04:02,119 --> 00:04:08,720
Now, once you know that you can trust your web server, you can establish a secure channel.

52
00:04:08,720 --> 00:04:14,520
And in this secure channel, you are going to encrypt the data with the web server public key.

53
00:04:14,520 --> 00:04:17,559
And then the data arrives at the web server.

54
00:04:17,559 --> 00:04:22,359
And only with the web server private key, the data can be decrypted.

55
00:04:22,359 --> 00:04:26,519
And that is what's happening between common HTTPS traffic, for instance.