digital certificate


Also found in: Dictionary, Thesaurus, Medical, Legal, Financial, Acronyms, Wikipedia.

digital certificate

(communications, security)
An attachment to an electronic mail message used for security purposes, e.g. to verify that a user sending a message is who he or she claims to be, and to provide the receiver with the means to encode a reply.

An individual wishing to send an encrypted message applies for a digital certificate from a certificate authority (CA). The CA issues an encrypted digital certificate containing the applicant's public key and a variety of other identification information. The CA makes its own public key readily available on the Internet.

The recipient of an encrypted message uses the CA's public key to decode the digital certificate attached to the message, verifies it as issued by the CA and then obtains the sender's public key and identification information held within the certificate.

digital certificate

The digital equivalent of an ID card used in conjunction with a public key encryption system. Also called a "digital ID," "digital identity certificate," "identity certificate" and "public key certificate," digital certificates are issued by a trusted third party known as a "certification authority" (CA) such as VeriSign (www.verisign.com) and Thawte (www.thawte.com).

The CA verifies that a public key belongs to a specific company or individual (the "subject"), and the validation process it goes through to determine if the subject is who it claims to be depends on the level of certification and the CA itself.

Creating the Certificate
After the validation process is completed, the CA creates an X.509 certificate that contains CA and subject information, including the subject's public key (details below). The CA signs the certificate by creating a digest (a hash) of all the fields in the certificate and encrypting the hash value with its private key. The encrypted digest is called a "digital signature," and when placed into the X.509 certificate, the certificate is said to be "signed."

The CA keeps its private key very secure, because if ever discovered, false certificates could be created. See HSM.

Verifying the Certificate
The process of verifying the "signed certificate" is done by the recipient's software, which is typically the Web browser. The browser maintains an internal list of popular CAs and their public keys and uses the appropriate public key to decrypt the signature back into the digest. It then recomputes its own digest from the plain text in the certificate and compares the two. If both digests match, the integrity of the certificate is verified (it was not tampered with), and the public key in the certificate is assumed to be the valid public key of the subject.

Then What...
At this point, the subject's identity and the certificate's integrity (no tampering) have been verified. The certificate is typically combined with a signed message or signed executable file, and the public key is used to verify the signatures (see digital signature and code signing). The subject's public key may also be used to provide a secure key exchange in order to have an encrypted two-way communications session (see SSL). See PKI.

Major Data Elements in an X.509 Certificate

 Version number of certificate format
 Serial number (unique number from CA)
 Certificate signature algorithm
 Issuer (name of CA)
 Valid-from/valid-to dates
 Subject (name of company or person certified)
 Subject's public key and algorithm
 Digital signature created with CA's private key



Signing and Verifying a Digital Certificate
The signed certificate is used to verify the identity of a person or organization.
References in periodicals archive ?
This contract, known as KMI CI-1, encompasses the first capability increment of the DoD's KMI and includes the development and fielding of a system for providing high-assurance digital certificates to DoD and other government agency users for critical online identification and authentication in electronic commerce and data exchange.
In addition, the two companies will link the digitalme directory of users' personal information, based on NDS, with VeriSign's public digital certificate directory, containing over four million digital certificates.
Tumbleweed Validation Authority (VA Server) - A FIPS 140-2 high-performance multi-platform solution to process client digital certificate status queries using a number of different protocols including OCSP, SCVP, and VA certificate revocation lists (CRL).
The experience and expertise that Cinea brings to securing digital cinema content, along with the integrity and flexibility of their solution, made Cinea's Digital Cinema Certificate program an easy choice to provide digital certificates for the projector component of our customers Barco, Christie, and NEC.
The data integrity, access controls, and audit trails provided by digital certificates are not available through firewalls, passwords, and VPNs.
Once this is done, you are issued a digital certificate bearing your name.
QuoVadis provides outsourced technology and procedures that allow clients to issue high reliance digital certificates to their employees, customers, and partners.
Tumbleweed VA is the first fully open standards product to enable digital certificate status validation in large scale distributed computing environments through the introduction of a new Repeater-Responder architecture, a significant innovation in digital certificate validation and PKI.
Our customers expect the utmost in security and reliability when it comes to validating digital certificates and we have integrated nCipher's netHSM with the Tumbleweed Valicert Validation Authority to deliver a superior level of security and performance to our customers," said John Hines, Director of Validation Authority Product Development at Tumbleweed.
Gerard, Chairman & CEO, emphasized that, "The company's unique ability to provide digital certificate management services on a global basis is the key to the widespread deployment of "certs" required to unleash a series of greatly needed secure applications in our Internet-empowered world.
With the RSA Keon digital certificate management solution embedded, SymPhone provides:
Together, the combined products will enable the cost-effective validation of digital certificates to tens of millions of users without affecting network bandwidth.

Full browser ?