Trusted Server and Trusted Signer Overview

This document provides essential information about certificates and servers within the public key infrastructure.

• Root certificates from certification authorities are often self-signed, meaning they are signed with the authority's private key and include the public key.
• Intermediate certificates are signed by certification authorities. They incorporate the public key of the intermediate certificate and are digitally signed by the root certificate.
• This creates certificate chains, where each certificate is signed with the private key of the certificate above it in the chain, except for the root certificate, which is self-signed.
• A server maintains a truststore that contains certificates from trusted parties or Certificate Authorities used to validate other parties.
• Additionally, a server may have a keystore, which holds the private keys and the corresponding public key certificates.

Trusted Server

The trusted server mechanism is utilized when Orchestra operates as a client in an SSL connection. A typical SSL connection, also known as a handshake, occurs in four steps:

1. Orchestra initiates a connection to the server, and both parties exchange random numbers.
2. The server provides its public certificate. Orchestra validates the server's certificate by ensuring the server name matches the name in the public certificate.
3. Orchestra sends a third random number, encrypted with the server's public key, along with its own public certificate back to the server. This process generates a master key on both sides for subsequent communications.

In addition to the standard TLS handshake validation in step 2, Orchestra compares the server's certificate against its own truststore. If the server's certificate is not located in Orchestra's truststore, it is deemed untrusted. Therefore, it is essential to provide Orchestra with the server's public key as a security credential.

To upload the server certificate into Orchestra, follow these steps:

1. Create a credential by navigating to Security -> Credential -> Create.
2. Select the type "Trusted Server."
3. Under the "Authentication" tab, choose "Public Key Certificate" by clicking the ellipsis button on the right side of the row.
4. Import the X509 public certificate, typically with a .cer suffix.

Once the certificate is imported into Orchestra, you can select the trusted server credential from within the channel or environment entry.

Trusted Signer

The trusted signer mechanism allows for the additional validation of a certificate's authenticity. Certificate authenticity is verified by checking the entire certificate chain up to the root certificate.

The certificate chain can be added similarly to a trusted server, but in this case, the entire chain must be selected, rather than just the public certificate.