How Server Security Works

Your Red Hat Linux Secure Server provides security by incorporating an implementation of the SSL protocol into the Apache Web server and by the use of CA-approved digital certificates. SSL handles the encrypted communications and the mutual authentication between browsers and your Red Hat Linux Secure Server. The CA-approved digital certificate provides authentication for your Red Hat Linux Secure Server (the CA puts its reputation behind its certification of your organization's identity).

Encryption depends upon the use of keys (think of them as secret encoder/decoder rings in data format). In conventional or symmetric cryptography, both ends of the transaction have the same key, which they use to decode each other's transmissions. In public or asymmetric cryptography, two keys co-exist: a public key and a private key. A person or an organization keeps their private key a secret, and publishes their public key. Data encoded with the public key can only be decoded with the private key; data encoded with the private key can only be decoded with the public key.

You'll use public cryptography to create a public and private key pair. Then you'll create a certificate request, which contains your public key. You send your certificate request, proof of your company's identity and payment to a CA. The CA verifies the certificate request and your identity, and then sends back a certificate for your Red Hat Linux Secure Server.

Please Note

Test certificates are not the same as signed certificates. The purpose of a test certificate is to make sure that your Red Hat Linux Secure Server is running correctly. You can't use a test certificate for secure transactions over the Internet, because users' browsers won't automatically recognize the certificate and allow the secure connection to be made. More information on creating a test certificate is contained in the section called Getting a Test Certificate.

Signed certificates must be purchased from a CA. Signed certificates can be used to test your Red Hat Linux Secure Server and must be used to support secure transactions over the Internet. Once you've installed a signed certificate, users' browsers will automatically recognize the certificate and will allow your Red Hat Linux Secure Server to create a secure connection.

Signed certificates are not included with the Red Hat Linux Secure Server.

Your Red Hat Linux Secure Server needs a certificate signed by a CA, so that people who visit your website know you are who you claim to be. When a Web browser connects to a secure website, the browser asks for the identity of the organization behind the website. Before signing a certificate, a CA verifies that the organization requesting the certificate was actually who they claimed to be.

Most Web browsers that support SSL have a list of CAs whose certificates they will automatically accept. If a browser encounters a certificate whose authorizing CA is not in the list, the browser will ask the user to choose whether to accept or decline the connection.

The process of getting a certificate is fairly easy. A quick overview is as follows:

Create an encryption private and public key pair.
Create a certificate request based on the public key. The certificate request contains information about your server and the company hosting it.
Send the certificate request, along with documents proving your identity, to a CA.
When the CA is satisfied that you are indeed who you claim to be, they will send you a digital certificate.
Install this certificate on your Web server, and begin handling secure transactions.