Understanding Certificate Authorities

Anytime you implement SSL/TLS with mutual authentication (both client and server authenticate each other) you need the following three items:

• Server Certificate (issued by some trusted third party or certificate authority).

• Client Certificate (issued by the same trusted third party or certificate authority).

• Client and server both need a copy of a root certificate for the trusted third party. The root certificate has the crypto keys (public and private key) of the authority. Using these keys and the client and server certificates, each party is able to authenticate the other.

When you log on to an SSL/TLS server using your browser, you don’t have to worry about a Root Certificate because they come bundled with the browser. You don’t have to worry about having a client certificate because the web server doesn’t require “Client Side Authentication”.

Important:

When you are importing a digital certificate, you may receive an error message if you attempt to import the digital certificate immediately after downloading it from a certificate authority. This is due to issues related to "valid from" dates and times, and the inconsistencies in time settings between different computers. You should save the certificate to a Microsoft Windows workstation, right click on it using Microsoft Windows Explorer, and select Open. This opens the Certificate dialog box. Examine the information regarding the “valid from” and “to” dates. Make sure those dates are valid on the application server the certificate will be installed on. The Details tab on the Certificate dialog presents the most thorough information.