Secure in-band update of trusted certificates

Abstract

The certificate authority (CA) is the central trust point in a public key infrastructure (PKI). Great care should be taken by users when they make a decision to trust a CA. Unfortunately, the average user will rely on the software to provide an appropriate security warning when something has gone wrong and therefore may not give much thought to the decision when performing such a security operation. The updating of a CA certificate is an issue that needs to be accomplished in a secure manner with little or no intervention by a user. Techniques are now in use that can allow for update of a CA's certificate. The Secure Electronic Transaction's (SET) root certificate update method is just one example, but in a specialized case. This paper discusses a practical solution that potentially any CA could use to provide a secure in-band update of a CA's X.509 v3 certificate into a user's personal security environment (PSE). A method is also discussed that Java programmers can use for update of self-signed X.509 v1 personal certificates in Java keystores as well.