> # Information About Certificate Authorities and Digital Certificates

> Public Key Infrastructure (PKI) support provides the means for the Cisco MDS 9000 Family switches to obtain and use digital certificates for secure communication in the network. PKI support provides manageability and scalability for IPsec/IKE and SSH.

> Certificate Authorities (CAs) manage certificate requests and issue certificates to participating entities such as hosts, network devices, or users. The CAs provide centralized key management for the participating entities.

> Digital signatures, based on public key cryptography, digitally authenticate devices and individual users. In public key cryptography, such as the RSA encryption system, each device or user has a key-pair containing both a private key and a public key. The private key is kept secret and is known only to the owning device or user only. However, the public key is known to everybody. The keys act as complements. Anything encrypted with one of the keys can be decrypted with the other. A signature is formed when data is encrypted with a sender’s private key. The receiver verifies the signature by decrypting the message with the sender’s public key. This process relies on the receiver having a copy of the sender’s public key and knowing with a high degree of certainty that it really does belong to the sender and not to someone pretending to be the sender.

> This section includes the following topics:

> - Purpose of CAs and Digital Certificates
> - Trust Model, Trust Points, and Identity CAs
> - RSA Key-Pairs and Identity Certificates
> - Multiple Trusted CA Support
> - PKI Enrollment Support
> - Manual Enrollment Using Cut-and-Paste Method
> - Multiple RSA Key-Pair and Identity CA Support
> - Peer Certificate Verification
> - CRL Downloading, Caching, and Checking Support
> - OCSP Support
> - Import and Export Support for Certificates and Associated Key-Pairs

> Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.