Security, Certificates, and User/Role Administration
Domain 6 tests security administration: certificates, keystores, authentication, and authorization. The exam expects you to separate identity, transport security, and permissions.
Certificates and keys
- Personal certificate: your identity, with private key, used for signing and decryption.
- CA/trusted certificate: used to validate partner or server certificates.
- Keystore holds private keys; truststore holds trusted public certificates.
- SSL/TLS uses the truststore for outbound validation; inbound may require client certificates.
- Expiry, revocation (CRL/OCSP), and key rotation are operational duties.
Users, roles, permissions
Users belong to groups; groups carry roles and permissions. LDAP/SSO can externalize authentication while authorization stays local. Apply least privilege: operations staff need monitoring and restart rights, not certificate management. Audit user and admin actions and review dormant accounts.
Worked example
Inbound AS2 messages fail signature verification. The partner's certificate is in the truststore but expired. Replace it with the renewed certificate, verify the alias and validity dates, and retest. Reasoning: signature verification uses the partner's public certificate; an expired trust entry fails validation even if the private key is fine.
Traps
- Importing a personal certificate without its private key.
- Confusing signing certificates with encryption certificates.
- Granting administrator rights to all operators.
- Forgetting that certificate renewal affects both trust and keystores.
- Disabling hostname verification to "fix" TLS.