Digital Certificates: Applied Internet Security

Because the Internet is based on connectionless protocols that route messages through more or less public machines, standard means of Internet communication offer no guarantees of integrity or authenticity. A variety of schemes have sprung up to solve this problem, and Digital Certificates: Applied Internet Security does a great job of explaining the Microsoft approach to securing Internet communications.

Helpfully, the authors spend a fair amount of time explaining the problem of network security and the broad technologies (public-key encryption, key length considerations, authentication, and so on). Having explained the universe in which a security system must work, they then show how to acquire a digital certificate from a certification authority (CA). From there, they show how to use the digital certificate with several pieces of software, including Internet Explorer 3 and 4 (but not 5), Netscape Communicator 4, and Outlook Express 4.

Of more interest to administrators and developers are code snippets that show how to request and process digital certificates in a variety of environments, including Active Server Pages (ASP) and Java. There's background information on the newly standardized Public Key Infrastructure with X.509 (PKIX) and the Secure Electronic Transaction (SET) standard for financial operations too. Coverage of Microsoft Certificate Server includes a lot of programming information, including coverage of the Policy and Exit Modules. --David Wall

Topics covered: Encryption, authentication, X.509 digital certificates, certification authorities, S/MIME, trust relationships, and Microsoft Certificate Server.