- [Instructor] Digital certificates may be used
for authentication.
Among other uses,
they may be used to connect to servers by SSH,
to power smart cards,
and for restricting network access to specific devices.
When you use digital certificates for authentication,
you create a digital certificate
similar to the one used to secure websites.
The certificate's purpose is to provide a trusted copy
of a public key to third parties.
You retain the corresponding private key
to prove that you are the owner of the public key
in the certificate.
Before we dive into certificates,
let's talk about how we can use keys for authentication.
I'll describe the process and then show it to you in action
with an SSH connection.
When you want to use keys for encryption,
you first create a public-private key pair.
You retain the private key a secret knowledge
and then share the public key
with a server you wish to authenticate to.
When you attempt to log in to a server
using key-based encryption,
the server generates a random message and sends it to you.
You take that message and encrypt it using your private key
and then send the encrypted message back to the server.
The server decrypts this message with your public key
and if it matches the original message
knows that you have access to the secret private key
proving your identity and authenticating the connection.
This provides basically the same level of protection
as a strong password,
but the major benefit of key-based encryption
is that it can be automated.
One server can connect to another
using certificate-based authentication
without someone entering a password.
Let's go ahead and give this a try on a Linux system.
I'm at the Amazon Web Services Management Console
and I'm going to go ahead and create an EC2 server instance.
We'll just use Amazon Linux.
I'm just going to create a very basic server.
All these details look fine.
I'm going to go ahead and launch that server
and then when I click launch,
notice that it asks me to identify the key pair
that I would like to use.
It talks about the public-private key concept
that we just discussed.
Amazon would like to know if I want to use
an existing key pair or create a new one.
I'm going to go ahead and create a new key pair.
We'll call this test key
and I'll click download
and notice a file named testkey.pem
was just downloaded to my computer.
That pem file contains the private key
from the public-private key pair that Amazon just created.
The public key will be stored on the EC2 server
that I'm about to create
so let's go ahead and click launch to create that server.
The server is now being launched in the cloud
and in a moment I'll be able to connect to it.
I'll go ahead and look at the instances I have
to see when the server is ready.
And once the pending state changes to running,
we'll able to connect to this new server.
Now that the server is running,
I can go ahead and try a connection to it.
I see that its public IP address is 54.87.188.30.
I'm going to go ahead and now open a terminal window
on my Mac.
I'm going to switch to the downloads folder
where I can see the testkey.pem file is stored.
There it is.
I'm going to go ahead and look at the contents of this file.
And as you can see, this is an RSA private key.
It's encoded in ASCII format here for readability purposes.
This is basically the password to my server.
Now I'm going to go ahead
and destroy this server in just a moment
so I don't mind sharing this private key right now
because it will become useless.
But in general, you should never share your private key.
If someone gets access to your private key,
they will be able to connect to
and take control of your server.
So let's go ahead and use this key
to connect to the server in AWS.
I'm just going to clear the screen here
and then I'm going to type the command ssh
then I'm going to use the minus i flag
to indicate that I would like to use a key file
and that key file is stored in the downloads folder
where I am currently so I don't need to give it a path
and it's called testkey.pem.
Then I simply say the username
that I would like to connect with
and this user happens to be ec2-user, the @ symbol,
and the IP address of my server which was 54.87.188.30.
I go ahead and hit enter
and I first get a message saying
the authenticity of the host can't be established.
That's because this key is not contained
within a digital certificate.
It does give me the fingerprint of the key
and then I'll just go ahead and type yes to accept it.
Now I see an error message saying
that I have an unprotected private key file.
The server is configured to make sure
that I have added appropriate security to my private key.
I just downloaded this to my computer
and accepted the default permissions
so it's giving me this error.
What I'm going to do now
is go ahead and set more restrictive permissions
on the key file and give this another try.
I'm going to use the chmod command
to go ahead and change permissions on the file.
I'm going to change it to 0600
and this will give only the owner of the file access to it
and it's the testkey.pem file.
Now I'm going to go ahead and try the ssh command again
and I'm connected to the server in the cloud.
That's how you use key-based encryption
to connect to a server using SSH.
Certificate-based authentication goes a step further
and has the public key signed
by a trusted certificate authority.
This gives the remote system assurance
not only that you have the private key,
but also that you are who you claim to be.
Certificate-based authentication may be used
for server-to-server connections like I just demonstrated.
It's also the enabling technology
behind PKI-based smart cards
such as the Federal Government's common access card
and personal identity verification card.
And certificated-based authentication can be used
with the IEEE 802.1x standard for network authentication.