Certificates and credentials

This page aims to give a simple introduction to the distinction between certificates and credentials.

Certificates

Digital certificates are now an accepted method by which systems can remotely distinguish trusted users. The name of the electronic document is X.509.

In normal use, the certificate is stored in a web browser: Firefox or Internet Explorer. However, this can be limiting in several ways, two of which are:

The Certificate Management Wizard can be used to solve these problems.

Credentials

In computing, the terms 'credentials' can mean a number of different things. The simplest is a username and password pair, by which a user can authenticate himself to some program or website. Under this definition, your X.509 certificate acts as credentials for whatever purpose you need authentication.

When you use this program, you will create 'proxy credentials'. These are secondary certificates signed by your digital certificate. Systems know that you have authorised these credentials and will therefore accept them in place of your certificate.

Why use proxy credentials?

One of the key concepts behind the use of a MyProxy server is the additional security of time-limited credentials over the .p12 or .pfx file that you can export from your computer's browser. Although each is only protected by a password, contained within the .p12 file is the actual private key for your certificate (as well as the certificate itself). If someone gains access to this, they'll have unlimited access to all the resources you have access to for as long as the certificate lasts.

The credentials uploaded to the MyProxy server, and the ones downloaded from it, are deliberately valid for a shorter length of time. If someone gains access to them, the access they have is much more limited.



Index