TLS concepts

A certificate authority (CA) issues digital identity certificates to identify computers to each other using the TLS protocol. Popular CAs include letsencrypt.org and verisign.com.

A public certificate authority (CA), issues server certificates to securely identify servers on the Internet. A CA also shares its CA certificate file for use by any computer. For example, operating systems contain public CA certificates from the major CAs. When a computer wants to validate the identity of a server, it uses the public CA certificate to validate the server certificate that it receives from the server.

Each organization may also be its own private certificate authority (CA) for computers on its internal network. It creates a CA certificate file that an administrator adds to its computers. When a computer wants to validate the identity of another computer in the internal network, it uses the organization's CA certificate to validate the certificate that it receives from the other computer. For example, a client computer can use a client certificate to identify itself to a server.

A CA certificate is a digital identity certificate issued by a public or private certificate authority (CA).

A CA shares its CA certificate file to allow computers to verify the identity of certificates signed by the CA. Operating systems contain public CA certificates from the major CAs so they can verify the identity of websites. Organizations create and distribute private CA certificate files to the computers inside their network so they can verify each other's identity.

In contrast, a server certificate or client certificate is a certificate signed by a CA to identify one specific computer.

"tls": {
  "certificateAuthoritiesFilename": "C:/Certificates/ca.crt",
  "certificateFilename":            "C:/Certificates/server.crt",
  "privateKeyFilename":             "C:/Certificates/server.key"
}

A digital identity certificate is an electronic document used by TLS to allow an application, such as a web browser, MQTT client, or server, to know when it is communicating with an intended computer rather than a fraudulent computer impersonating the intended computer.

A public certificate authority (CA), issues server certificates to securely identify servers on the Internet. A CA also shares its CA certificate file for use by any computer. For example, operating systems contain public CA certificates from the major CAs. When a computer wants to validate the identity of a server, it uses the public CA certificate to validate the server certificate that it receives from the server.

Each organization may also be its own private certificate authority (CA) for computers on its internal network. It creates a CA certificate file that an administrator adds to its computers. When a computer wants to validate the identity of another computer in the internal network, it uses the organization's CA certificate to validate the certificate that it receives from the other computer. For example, a client computer can use a client certificate to identify itself to a server.

To create a certificate, you first create a private key to its own file called a private key file with a .key file extension. You then create a certificate signing request (CSR) file that contains the public key of the key pair you generated as well as identity information about the computer, such as its domain or hostname. A CA signs the CSR file using its own closely held private key. This creates a certificate file that contains the digital certificate that identifies a specific computer.

To use a certificate, you add the certificate and its corresponding private key file to the computer that wants to use the TLS protocol to share its identity with other computers. TLS uses the certificate and the key file to securely transmit the identity of a computer. On the computer that wants to use TLS to verify the identity of another computer, you add the CA certificate to enable the computer to verify the certificates it receives from other computers.

A certificate file contains the certficate required by TLS to prove the identity of a computer.

The certificate file often has the extension, .crt, such as server.crt or client.crt. It may also have one of the file extensions: .cer, .pem, .ca-bundle, .p12, .pfx, etc.

A PEM (privacy-enhanced mail) file often combines multiple certificates and the private key in one file.

"tls": {
  "certificateAuthoritiesFilename": "C:/Certificates/ca.crt",
  "certificateFilename":            "C:/Certificates/server.crt",
  "privateKeyFilename":             "C:/Certificates/server.key"
}

A client certificate is a digital identity certificate that a client computer uses to identify itself to a server computer.

Various software libraries and computer languages use different properties to configure TLS, but they all provide some way to specify a CA certificate file, client certificate file, and private key file.

client.tls_set( ca_certs = "/Certificates/ca.crt", certfile = "/Certificates/client.crt", keyfile = "/Certificates/client.key" )

A certificate signing request (CSR) is a file that contains the identity information needed to create a certificate. A CA creates a certificate by signing a CSR file using its own closely held private key.

The identity information in the CSR file includes the computer's domain name, hostname, and potentially other information defined by the X.509 standard. In addition, a CSR file always includes the public key of a public-private key pair that is crypto-randomly generated to identify the computer. The private key of the public-private key pair is stored separately from the certificate in a private key file.

A certificate file and its corresponding private key file are required by the TLS protocol to identify a computer to other computers.

A private key is the secret required by TLS to prove the identity of a computer. It is the private key of the public-private key pair that is used to create a computer's digital identity certificate. It is stored in a private key file.

In TLS, the private key and the certificate are both required to verify the identity of a computer.

The TLS handshake verifies a server's identity by requiring the client computer to encrypt a calculated secret using the public key in the server certificate and then requiring the server computer to decrypt the calculated secret using its private key.

The TLS handshake verifies a client's identity by requiring the client computer to encrypt a calculated secret using its secret in its private key and then requiring the server computer to decrypt the calculated secret using the public key in the client certificate .

This approach verifies the identity of a computer because a computer can successfully encrypt or decrypt a calculated secret only when it has the private key. Thus, the private key file contains the secret key that identifies a computer and the certificate file contains the public key that validates identity.

A private key file is a file that contains the private key required by TLS to prove the identity of a computer. The private key file contains the private key of the public-private key pair that is used to create a computer's digital identity certificate . The private key file typically has the extension, .key, such as server.key or client.pem.

When you create a certificate, you first create a public-private key pair for a specific computer. You save the private key to its own file with a .key file extension. This is the private key file . The certificate file contains the public key from the public-private key pair .

In TLS, the private key file and the certificate file are both required to verify the identity of a computer.

A public-private key pair is a pair of asymmetrical keys. The private key can encrypt a secret and only the public key can decrypt that secret. This also works in reverse where the public key can encrypt a secret and only the private key can decrypt that secret.

TLS uses a public-private key pair to establish the identity of a computer. It does this by putting the private key in a private key file that is stored only on the computer being identified. It then requires the public key to be embedded in a certificate that is shared with other computers. When a client computer wants to verify the identity of a server computer, the TLS protocol requires the client computer to encrypt a calculated secret using the public key in the certificate and requires the server computer to successfully decrypt the calculated secret using its private key. Since the only way to decrypt the calculated secret is to have the private key file , it proves the identity of the server. Verifying client identity to a server is a similar process.

The private key file contains the secret key that identifies a computer and the certificate contains the public key that validates identity.

A server certificate is a certificate that a server computer uses to identify itself to client computers.

In FairCom servers, you configure TLS to use a certificate by setting the "tls" property in listeners in the services.json file. The "certificateAuthoritiesFilename" property specifies the CA certificate file. The "certificateFilename" property specifies the server certificate file. The "privateKeyFilename" property specifies the private key file. When the certificate and private key are combined into one file, assign the file to the "certificateFilename" property.

"tls": {
  "certificateAuthoritiesFilename": "C:/Certificates/ca.crt",
  "certificateFilename":            "C:/Certificates/server.crt",
  "privateKeyFilename":             "C:/Certificates/server.key"
}

TLS handshake is a series of requests by a client computer and the corresponding responses by a server computer.