What is a registration authority?
A registration authority (RA) is the part of a public key infrastructure that checks who is asking for a certificate before one is issued. It verifies the applicant's identity, confirms they are entitled to the certificate requested, and passes approved requests to the certificate authority (CA). The CA alone holds the signing key and issues the certificate. RFC 5280 describes the RA as an optional component to which a CA can delegate these front-office duties.
What an RA does
- Checks identity documents or directory records for the person, server or device named in a request.
- Confirms the requester's authority, for example that an administrator may request a certificate for a particular server or domain.
- Approves or rejects certificate requests and forwards approved ones to the CA.
- Often handles revocation requests, renewals and reports of lost tokens, and may authorize key recovery where keys are escrowed.
An RA never signs certificates. It has no access to the CA's private key, so even a compromised RA can only approve bad requests; it can't mint certificates on its own, and its approvals leave an audit trail.
RAs in practice
Large organizations use RAs to place identity checks close to the people being checked. Government smart card programs such as the U.S. federal PIV card rely on registrars at many sites who inspect two identity documents in person before a card and its certificates are issued. In Microsoft Active Directory Certificate Services, an enrollment agent, often a security officer, can request smart card certificates on behalf of users after checking their ID, and the Network Device Enrollment Service (NDES) acts as an RA for routers and mobile devices that enroll through SCEP. Public CAs keep the RA function in their validation teams, and some delegate parts of it to partners.
When an RA is compromised
Separating the RA from the CA limits damage but doesn't eliminate it. In March 2011 an attacker took over a user account at a registration partner of the CA Comodo and pushed through nine fraudulent certificates for sites including Google, Yahoo, Skype and Mozilla's add-ons site. Comodo's CA signed them because it trusted the RA's approvals. Comodo revoked the certificates quickly once the activity was noticed, and browser vendors blocked them in updates. The lesson is that RA credentials need the same protection as any privileged account: strong MFA, least privilege and review of approvals.
Registration authority vs. certificate authority vs. validation authority
| Role | Main job | Holds the CA signing key? |
|---|---|---|
| Registration authority | Verifies identity and approves requests | No |
| Certificate authority | Signs and issues certificates and CRLs | Yes |
| Validation authority, such as an OCSP responder | Answers whether a certificate is still valid | Usually not; it signs answers with a delegated key |
In a small PKI one team or server may perform all three roles. The RA's identity check is a form of identity proofing, the same process used to enroll users into any identity system.
Registration authority on the CompTIA Security+ exam
Registration authorities are taught with certificate authorities and the other PKI components under SY0-801 objective 1.3, the cryptographic solutions objective. Wording such as "verifies a requester's identity before the certificate is issued" or "approves certificate requests but cannot issue certificates" points to the RA. "Signs the certificate" points to the CA, and "answers real-time status queries" points to OCSP. A common distractor is the CA itself, since many small PKIs combine the roles.