Home > Ask the Security Experts > Identity Management and Access Control Questions & Answers > Creating a personal digital certificate
Ask The Security Expert: Questions & Answers
EMAIL THIS

Creating a personal digital certificate

Joel Dubin, past SearchSecurity.com expert EXPERT RESPONSE FROM: Joel Dubin, past SearchSecurity.com expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 11 April 2007
I want to create a personal digital certificate for a company, instead of requesting it from a certificate authority. Is this advisable, and what steps should I follow?


BROWSE BY TAG
Identity Management and Access Control,   PKI and Digital Certificates,   Enterprise Identity and Access Management,   User Authentication Services,   NAC and Endpoint Security Management,   Enterprise Network Security,   Network Access Control Basics,   Expert Archive: Identity Management and Access Control,   VIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


RELATED CONTENT
Identity Management and Access Control
Learn about enterprise strategy for server virtualization single sign-on
Employee information security awareness training for new IAM systems
Can you combine RFID tag technology with GPS to track stolen goods?
Is there a free enterprise-caliber password-management tool?
Cryptosystem attacks that do not involve obtaining the decryption key
Can any firm or organization get a digital signature certificate?
Should the CTO have domain administrator access?
Does password sharing in international branches violate SOX?
What are best practices for secure password distribution after a data breach?
Is it possible to encrypt CDs and DVDs as well as SD cards?

PKI and Digital Certificates
Portable security storage device could replace OTP devices
What is most misunderstood about EV SSL certificates?
VeriSign addresses MD5 flaw
Rogue digital certificates strike blow to Internet security
Can any firm or organization get a digital signature certificate?
How to obtain a digital certificate for a server
PKI and digital certificates: Security, authentication and implementation
What is the best way to administer exams to students via computer?
Should computer exams be transmitted as PDF files or Word files?
Should PKI systems be used for laptop encryption?
PKI and Digital Certificates Research

Network Access Control Basics
Symantec offers endpoint protection management, monitoring services
Configuring access control lists
What is the difference between a VPN and remote control?
Quiz: Endpoint security on a budget
Opinion: Gartner gets NAC wrong, again
What security software should be installed on Internet café computers?
What are the best network security books?
Should the government reduce its external Internet connections?
Trustwave acquires NAC appliance vendor Mirage Networks
Product Review: Rohati TNS 100

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
authentication server  (SearchSecurity.com)
Certificate Revocation List  (SearchSecurity.com)
Digital Signature Standard  (SearchSecurity.com)
HDCP  (SearchSecurity.com)
MD2  (SearchSecurity.com)
MD4  (SearchSecurity.com)
MD5  (SearchSecurity.com)
nonrepudiation  (SearchSecurity.com)
PKI  (SearchSecurity.com)
public key  (SearchSecurity.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


The only reason to create a personal digital certificate for a company is to acquire internal access . Otherwise, it won't be recognized by outsiders, unless it's registered with a certificate authority (CA), which could be a problem. For example, your Web site might depend on SSL, which requires publicly available digital certificates.

Without the CA seal of approval, you'd have to distribute the digital certificate on your own. Since most browsers have a built-in list of publicly known CAs, your personal digital certificate won't be recognized on the Web.

CAs are approved by the registration authority (RA), a trusted third-party that issues and verifies digital certificates. Remember, a digital certificate is like a driver's license. It's universally recognized because it's issued by a reliable source, like how a license is issued by a department of motor vehicles.

That doesn't mean you shouldn't issue your own certificate. If you're in a large organization and want to use it internally, it might make sense. Internally generated digital certificates can be used to verify network access for employees in distant departments. The digital certificate can provide additional authentication for access to files or systems from someone in a far away department.

Issuing digital certificates on your own can be done through a public key infrastructure (PKI). PKI is a dedicated system, or cluster of servers, that handles the creation of public keys associated with digital certificates. The PKI system creates, maintains and revokes certificates as needed.

PKI systems can be complicated and costly, but if your organization is large enough and the demand is there, it's worth it.

For more information:

  • In this expert Q&A, Ed Skoudis reveals what research needs to be done before importing a digital certificate into your browser.
  • In this SearchSecurity.com expert answer, application security pro Michael Cobb emphasizes the importance of keeping your digital certificates up-to-date.




  • Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Find Security Solutions for Your Business
    Targeted Security Channel Tips for Resellers, Integrators and Consultants
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts