Digital Certificates and Secure Web Access

Digital Certificates and Secure Web Access

Introduction

This paper describes the use of Digital Certificates as a mechanism for strongly authenticating users to web sites where identity information is required. Before the advent of digital certificates the only option for authenticating users to a site was to assign a username and password. Digital certificates on the other hand provide for much more robust access control and have a number of benefits over username and password.

Username and password authentication

Using username and password the process is generally as follows: each time a user wishes to access a web service the user navigates to the site and authenticate themselves to the application using unique username and password. This data is passed to the server (hopefully in an encrypted form), the application looks up the username and the password (or a representation of the password) in some form of access control list and provided the information matches the user is granted access.

This method has some obvious limitations:

* The username and password are passed over the web (encrypted or unencrypted) with the typical security concerns of interception.
* The systems administrator normally has unrestricted access to all usernames and passwords with associated security and liability concerns for the service provider (especially with confidential data)
* The user needs to remember as many usernames and passwords as are required by their applications leading to inevitable support issues to recover lost access data

Digital Certificate Authentication

The typical digital certificate web access process is:

The user navigates to the website. Before allowing access it checks the certificate against the access database. The user enters the password locally to confirming their access right to the certificate and is allowed to the website.

Benefits of certificates over username and password:

* General security is enhanced: the user needs both the certificate itself and the password to the certificate to gain access.
* The password is never passed over the web, not even during account set-up.
* At no stage do systems administrators have access to user passwords.
* The certificate can electronically sign data on the website with the benefit of non-repudiation.
* The user uses one digital identity with one password to access a range of applications (reduces passwords to remember).

Implementing Digital Certificates

All major web servers support client authentication via certificates. An SSL certificate on the web server (to support https) enables configuration of client authentication and only requires specification of the access rights for each directory served by the web server. Amend the web application to support client authentication by certificates. If any code was developed to handle user name and password, then the certificate credentials can be looked up in an access control list in just the same way. Client certificates are issued via a Public Key Infrastructure (PKI) You can choose implement your own or use the services of a Managed Service Provider such as Diginus Ltd.

Wider Use

Once customers or employees have digital certificates, the same certificates can be used to digitally sign email, PDF and web forms and Microsoft Word documents. With a few small steps a corporate website can be transformed into the centre of a powerful web services infrastructure, with single sign on to multiple web applications, signed email and forms data exchange, all the time knowing exactly who is accessing the resources and data.

Jonathan Gay BA(hons) CISA MBCS, is an IS Security professional specialising in identity management and Public Key Infrastructure (PKI) related matters. Jonathan works for Diginus Ltd the e-identity solutions company.

You can contact Jonathan via the Diginus Ltd web site www.diginus.com

SSL Certificates: The Credit Card Protector

So you want to create a site, that will take get people to pay online. In order for them to do this they need to pay with Credit Card. So you purchase an account with an online Merchant, and want your site to collect the Credit Card information to collect payment.

Now can you do this on your normal page? No, you should not! Why? Because if the page is not secure, then the potential of your customers credit card number getting in the wrong hands is likely! And we don't want such a thing to happen to our customers. So how do we protect the Credit Card Number? A Thing we call SSL Certificates.

First things first. What is a SSL Certificate?

A SSL Certificate makes your site have a URL with https instead of just http. What does that little s make a difference? It does because with the Certificate, your page is encryped in a Secure fashion, and other groups are not able to view what you do online, and are not able to get secure information such as the credit card number. The goal of the SSL Certificate is to keep your information exchange or purchases with credit card transactions encrypted and secure.

What else does an SSL Certificate do for me?

The main positive aspect of an SSL Certificate, is it shows customers they can do business with you safely. Your visitors, prospects, and customers are on their guard and worry about their personal and financial information being leaked to people who should be getting it. You can turn these same customers' concerns into a competitive advantage by showing them you keep their information a secure manner. With SSL Certificates 256-bit encryption and 99% browser recognition, customers can be confident that their information will not be put in the wrong hands.

The SSL Certificate verifies:

You were approved to be issued the certificate.

WebTrust Seal of assurance for Certification Authorities

Make sure you get your SSL Certificate to Boost Customer Confidence in purchasing online on your site, and to protect those Credit Card Numbers from falling into the wrong hands!

Domains at Retail is a high quality SSL Certificate Reseller created to help everyone get the cheapest rate for SSL Certificates and the cheapest rate for Domain Names and Web hosting solutions on the Internet (http://www.domainsatretail.com/securessl.html)

Visit at: http://www.domainsatretail.com Download our Free Web Site Startup Ebook: http://www.domainsatretail.com/DomainsAtRetail.pdf