The

PKI is a set of roles, policies, hardware, software, and procedures necessary to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption. PKI facilitates the secure electronic transfer of information in a network. This technology primarily secures electronic transactions, confirms the identity of individuals and devices, and protects the integrity of distributed data.

PKI is built upon asymmetric cryptography, which employs a pair of keys: a private key and a public key. While the private key remains confidential and in the sole possession of the owner, the public key is made freely available in a public directory. Through this framework, anyone can encrypt a message using a public key, but only the private key holder can decrypt it. This duality of keys forms the foundation of authentication, confidentiality, and integrity assurances in a PKI system.

An Issuing Certification Authority (CA), part of the hierarchical PKI structure, plays a crucial role in the management and verification of digital certificates. It issues, validates, and revokes digital certificates.

The process begins when an entity (a person or a system) generates a pair of cryptographic keys and sends a Certificate Signing Request (CSR) containing the public key and some identifying information to the CA. The CA validates the authenticity of the request and the identity of the requester and then uses its private key to sign the public key of the entity, creating a digital certificate. You can then publicly share this digital certificate, acting as a form of digital ID, to establish the identity of the entity and the authenticity of its public key.

An Issuing CA is typically subordinate to the Root CA in the PKI hierarchy. While the Root CA's private key is highly secured and used sparingly, the Issuing CA's private key is used more frequently to sign end-entity certificates. This arrangement maintains the security and integrity of the Root CA while providing the operational flexibility needed to handle the vast number of requests for new certificates.

In summary, the Issuing CA acts as a trusted third party in the PKI structure, facilitating trust in digital transactions and communications. It ensures that the entities involved in these exchanges are who they claim to be, which is foundational to secure digital interactions.

The

You can manage the

This guide uses the remote desktop interface to illustrate managing keys and key groups.

This guide discusses the following concepts:

The following sections cover these topics in detail.