Chapter 8 – Certificate Services on Linux

1. The first function is the most important and is most often overlooked. A certificate provides trust and authentication. The fact that the hostname matches either the CN or SAN fields in the certificate provides the authentication needed to start the session. The fact that the certificate is signed by a trusted CA means that the authentication can be trusted by the client. This will be revisited again in the next chapter of this book, Chapter 9, RADIUS Services for Linux.

   The second function is that the certificate material is used to provide some of the material for the secret key that is used in the symmetrical encryption of the subsequent session. Note, though, that as we progress to other use cases, many situations that make use of certificates do not do session encryption at all—the certificates are there purely for authentication.

2. The PKCS#12 format, often seen with a suffix of .pfx or sometimes .p12, combines the...