Dell EMC SmartFabric OS10 User Guide Release 10.5.0

X.509v3 concepts

Certificate

A document that associates a network device with its public key. When exchanged between participating devices, certificates are used to validate device identity and the public key associated with the device. A PKI uses the following certificate types:

• CA certificate: The certificate of a CA that is used to sign host certificates. A CA certificate may be issued by other CAs or be self-signed. A self-signed CA certificate is called a root certificate.
• Host certificate: A certificate that is issued to a network device. A host certificate may be signed by a CA or self-signed.
• Self-signed certificate: A host-signed certificate, compared to a CA-signed certificate.

Certificate authority (CA)

An entity that verifies the contents of a certificate and signs it, indicating that the certificate is trusted and correct. An intermediate CA signs certificates transmitted between a root CA and a host.

Certificate revocation list (CRL)

A CA-signed document that contains a list of certificates that are no longer valid, even though they have not yet expired. For example, when a new certificate is generated for a server, and the old certificate is no longer supported.

Certificate signing request (CSR)

After generating a key pair, a switch signs a request to obtain a certificate using its secret private key, and sends the request to a certificate authority. The CSR contains information that identifies the switch and its public key. This public key is used to verify the private signature of the CSR and the distinguished name (DN) of the switch. A CSR is signed by a CA and returned to a host for use as a signed host certificate.

Privacy Enhanced Mail (PEM)

PKI standard used to format X.509v3 data in a secure message exchange; described in RFC 1421.

Public key infrastructure (PKI)

Application that manages the generation of private and public encryption keys, and the download, installation, and exchange of CA-signed certificates with network devices.

X.509v3

Standard for the public key infrastructure that manages digital certificates and public key encryption.