ccna blueprint

ccna blueprint.7.4.6.3 Complex PKI TopologiesDue to the hierarchical nature of the PKI, the nJof the certification authority issuing the certificate is either a root CA (the top CA in the hierarchy) or a slave CA. the PKI can also use an additional host called a registrationauthority.RA to accept requests registered in the PKI. RAs are used to reduce the burden on CAs in environments that support high-flying certificate transactions, or where the J-CA is not online.In more complex environments, RA tasks may also include verifying user identities, creating passwords for certificate management transactions, submitting registration requests to the CA with appropriate organizational attributes or other information, and handling various tasks such as certificate revocation and re-enrollment. The following tasks are typically assigned to RAs. Authenticating users when they register with the PKI; generating keys for users who cannot generate n their own keys.Distributing certificates after registration|9 Note that RAs only have the right to accept registration requests and forward them to CAs, and are not allowed to issue certificates or publish CRLs.These functions are handled by the CA. How are certificates obtained, registered, and used in authentication?7.4.7 Digital Certificates and CAs7.4.7.1 Step 1: Obtaining a CA CertificateIn the CA certification process, the first step when a user contacts the PKI. The first step is to securely obtain a - copy of the CA public key. The public key validates all certificates issued by the CA and is critical to the proper operation of the PKI. The public key, called a self-signed certificate, is also distributed as a copy of the certificate issued by the CA itself. Only the root CA issues self-signed certificates.