{"id":38686,"date":"2019-10-31T22:25:18","date_gmt":"2019-10-31T19:25:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/alternativa-tsentru-sertifikatsii-ot-microsoft\/"},"modified":"2019-10-31T22:25:18","modified_gmt":"2019-10-31T19:25:18","slug":"alternativa-tsentru-sertifikatsii-ot-microsoft","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/alternativa-tsentru-sertifikatsii-ot-microsoft","title":{"rendered":"An alternative to Microsoft's certification center","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Users cannot be trusted. Most of them are lazy and choose comfort over security. According to statistics, 21% write down their passwords for work accounts on paper, and 50% use the same passwords for work and personal services.<\/p>\n

The environment is also hostile. 74% of organizations allow personal devices to be brought to work and connected to the corporate network. 94% of users cannot distinguish a legitimate email from a phishing one, and 11% have clicked on attachments.<\/p>\n

All these problems are addressed by a corporate Public Key Infrastructure (PKI), which provides encryption and email authentication, replacing passwords with digital certificates. This infrastructure can be set up on Windows Server. According to Microsoft's description<\/a><\/noindex>, the Active Directory Certificate Services (AD CS) is a server that allows you to create a PKI within your organization and use public key cryptography, digital certificates, and digital signatures.<\/p>\n

However, Microsoft's solution is quite expensive.
\n<\/a><\/noindex><\/p>\n

The total cost of ownership for a private certification center from Microsoft<\/h1>\n

\n\"An
\nComparison of the total cost of ownership between Microsoft CA and GlobalSign AEG. Source<\/a><\/noindex><\/i><\/p>\n

In many situations, it is more convenient and cheaper to create a similar private certification center but with external management. This is precisely what GlobalSign Auto Enrollment Gateway (AEG) addresses. Several expense lines are eliminated from the total cost of ownership (equipment purchase, support costs, staff training, etc.). Savings can exceed 50% of the total cost of ownership<\/a><\/noindex>.<\/p>\n

What is AEG<\/h1>\n

\n\"An
\n
\nAuto Enrollment Gateway<\/a><\/noindex> (AEG) is a software service that acts as a gateway between GlobalSign's SaaS certificate services and the Windows corporate environment.<\/p>\n

AEG integrates with Active Directory, allowing organizations to automate the registration, provisioning, and management of GlobalSign digital certificates in a Windows environment. By replacing internal certification centers with GlobalSign services, enterprises enhance security and reduce the costs of managing a complex and expensive internal Microsoft certification center.<\/p>\n

GlobalSign SaaS Certification Services provide a more reliable option compared to weak and unmanaged certificates on your own infrastructure. Reducing the need to manage resource-intensive internal CAs lowers the overall cost of PKI ownership, as well as the risk of system failures.<\/p>\n

Support for SCEP and ACME protocols expands support capabilities beyond Windows, including automated issuance of certificates for Linux servers, mobile devices, network devices, and other systems, as well as Apple OSX computers registered in Active Directory.<\/p>\n

Increased Security<\/h3>\n

\nIn addition to budget savings, external PKI management enhances system security. According to a study by Aberdeen Group, certificates are increasingly becoming targets for attackers: they successfully exploit known vulnerabilities such as insecure self-signed certificates, weak encryption, and cumbersome revocation mechanisms. Additionally, attackers have mastered more sophisticated exploits, such as fraudulent certificate issuance from trusted CAs and certificate forgery for code signing.<\/p>\n

\"Most organizations are not actively managing the risks associated with these attacks and are not prepared to respond quickly to a compromise,\" wrote<\/a><\/noindex> Derek E. Brink, Vice President and Research Fellow for IT Security at Aberdeen Group. \"By enabling organizations to delegate the operational aspects of certificate management to experts while maintaining corporate control over group policies in Active Directory, GlobalSign aims to ensure the future growth of certificate usage by addressing practical security and trust issues in an efficient, cost-effective deployment model.\"<\/p>\n

How AEG Works<\/h1>\n

\n\"An
\n
\nA typical AEG system includes four key components to ensure the correct certificates are delivered to the right access points:<\/p>\n

    \n
  1. AEG software on a Windows server.\n<\/li>\n
  2. Active Directory servers or domain controllers that allow administrators to manage and store resource information.\n<\/li>\n
  3. Endpoints: users, devices, servers, and workstations \u2014 virtually any object that is a 'consumer' of digital certificates.\n<\/li>\n
  4. The GlobalSign Certification Center, or GCC, sits atop a reliable certificate issuance and management platform. This is where certificates are generated.<\/li>\n<\/ol>\n

    \nThree out of the four components shown are in the client\u2019s local environment, while the fourth is in the cloud.<\/p>\n

    First, endpoints are pre-configured using group policies: for example, for certificate verification for user authentication, S\/MIME request for certificates, and so on \u2014 for subsequent connection to the AEG server. The connection occurs securely via HTTPS.<\/p>\n

    The AEG server sends a request to Active Directory via LDAP to obtain a list of certificate templates for these endpoints and sends this list to the clients along with the location of the certification authority. After receiving these rules, the endpoints reconnect to the AEG server, this time to request the actual certificates. AEG, in turn, creates an API call with the specified parameters and sends it to the GlobalSign Certification Center or GCC for processing.<\/p>\n

    Finally, the backend of GCC processes the requests, usually within a few seconds, and sends back the API response along with the certificate that will be installed on the endpoints upon request.<\/p>\n

    The entire process takes just a few seconds and can be fully automated by configuring the endpoints for automatic certificate retrieval through group policies.<\/p>\n

    Unique Features of AEG<\/h4>\n

    <\/p>\n