Network Security · Topic 2 of 7
Encryption and Certificates
Understand encryption in transit and at rest, symmetric and asymmetric keys, TLS, public key infrastructure, CAs and self-signed certificates.
- 4 min
- Data in transit is protected by TLS, IPsec or SSH. Data at rest is protected by disk or file encryption.
- Symmetric encryption uses one shared key and is fast. Asymmetric uses a key pair and is used for key exchange and signatures.
- The public key can be shared. The private key must stay secret.
What it is
Encryption turns readable data into unreadable data using a key, so that only someone with the right key can read it. It protects confidentiality when data crosses a network and when it is stored.
Certificates prove who owns a public key. A public key infrastructure (PKI) is the set of roles, software and rules that issue and manage those certificates.
How it works
Data in transit and at rest
Data in transit moves across a network, and is protected with protocols such as Transport Layer Security (TLS), Internet Protocol Security (IPsec) and Secure Shell (SSH). Data at rest sits on a disk, database or backup, and is protected with disk or file encryption.
Both matter. A stolen laptop exposes data at rest, and a captured packet exposes data in transit.
Symmetric and asymmetric encryption
| Type | Keys | Strength | Typical use |
|---|---|---|---|
| Symmetric | One shared secret key for both encrypt and decrypt | Fast | Encrypting bulk data |
| Asymmetric | A public key and a private key pair | Slower | Key exchange, digital signatures, certificates |
In asymmetric encryption, data locked with the public key can be opened only with the matching private key. The public key can be shared freely, and the private key must stay secret.
Real protocols combine both. Asymmetric methods set up the session and agree a key, and then fast symmetric encryption protects the actual data.
TLS
TLS secures traffic such as web browsing (Hypertext Transfer Protocol Secure, HTTPS), mail and directory services. The server presents a certificate, the client checks it, and the two sides agree on keys for the session.
TLS provides confidentiality, and it verifies the server's identity through its certificate. Older versions, including Secure Sockets Layer (SSL), are obsolete and should be disabled.
Public key infrastructure
PKI manages certificates. Its main parts are listed here.
| Part | Role |
|---|---|
| Certificate authority (CA) | Trusted organization that issues and signs certificates |
| Certificate | Binds an identity, such as a domain name, to a public key, signed by a CA |
| Certificate signing request (CSR) | A request created by the owner and sent to the CA to get a certificate |
| Revocation | Marks a certificate as no longer valid before it expires |
A client trusts a certificate when it is signed by a CA the client trusts, is not expired, is not revoked, and matches the name being visited.
Self-signed certificates
A self-signed certificate is signed by its own key instead of by a CA. It still provides encryption, but clients have no outside proof of the owner's identity, so browsers warn about it.
Self-signed certificates are acceptable for lab and internal testing. For public services, use a certificate from a trusted CA, and for internal services many organizations run their own private CA and distribute its trust to devices.
Certificate chain and expiry
A certificate is usually issued by an intermediate CA that is in turn signed by a root CA. The server must send the intermediate certificates so the client can build the chain to a trusted root.
Certificates have an expiry date. An expired certificate causes errors, so track expiry dates and renew in time.
What to remember for the exam
- Data in transit is protected by TLS, IPsec or SSH. Data at rest is protected by disk or file encryption.
- Symmetric encryption uses one shared key and is fast. Asymmetric uses a key pair and is used for key exchange and signatures.
- The public key can be shared. The private key must stay secret.
- TLS protects HTTPS and also checks the server's certificate. SSL is obsolete.
- A certificate authority issues and signs certificates. A CSR is the request.
- A self-signed certificate encrypts, but it does not prove identity to outsiders.
- Certificates expire and can be revoked.
- A missing intermediate certificate breaks the chain of trust.
For a browser warning about an untrusted certificate, check three things: whether the CA is trusted, whether the certificate has expired and whether the name matches.
Common mistakes
Assuming encryption in transit covers stored data. Data can be safe on the wire and still exposed on a disk.
Sharing the private key. Only the public key is shared. If the private key leaks, the certificate must be replaced.
Using self-signed certificates on public sites. Users get warnings and cannot verify the owner.
Forgetting renewal. An expired certificate takes a service offline for clients that check validity.
Mixing up asymmetric and symmetric roles. Asymmetric is for exchanging keys and signing, while symmetric encrypts the bulk data.
A certificate proves who the server is, not that the site is safe. Attackers can also obtain valid certificates for their own domains.
Check yourself
Answer these three.
Which type of encryption is faster, symmetric or asymmetric?
Symmetric, which is why it encrypts the bulk data in a TLS session.
What does a certificate authority do?
It verifies identity and signs certificates so others can trust the public key.
Why does a browser warn about a self-signed certificate?
No trusted CA has vouched for the owner's identity.
Topic 2 of 7 in Network Security
Test yourself on Network Security
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.