To implement a system based on public and private key pairs for secure communication across an intranet, a Public Key Infrastructure (PKI) is required. The core component of a PKI is the Certificate Authority (CA), which runs on a certificate server. This server is responsible for issuing, managing, distributing, and revoking digital certificates. These certificates bind identities (e.g., users, servers) to their public keys, creating a framework of trust that is essential for secure, authenticated, and encrypted communications within the organization.

A. Microsoft Internet Information Server (IIS) is a web server. It is a consumer of certificates for enabling HTTPS but is not the system that issues or manages them for the entire network.
B. A VPN (Virtual Private Network) is a service that uses certificates and keys to create secure communication tunnels but is not the infrastructure for managing the key pairs themselves.
C. An FTP server is a service for file transfer. While it can be secured with protocols that use certificates (FTPS), it is not the component that manages the PKI.

1. National Institute of Standards and Technology (NIST) Special Publication 800-32

"Introduction to Public Key Technology and the Federal PKI Infrastructure".

Section 2.1

"Public Key Infrastructure

" Page 6: States

"A typical PKI consists of hardware

software

policies

and procedures

and is composed of a number of components. These components include CAs [Certificate Authorities] that issue certificates

RAs [Registration Authorities] that may be used to verify the identity of entities requesting certificates

certificate repositories for storing and distributing certificates and CRLs [Certificate Revocation Lists]..." This directly identifies the Certificate Authority (implemented on a certificate server) as the core component for issuing certificates in a public key system.

2. Internet Engineering Task Force (IETF) RFC 5280

"Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile".

Section 1

"Introduction

" Page 5: "This specification is one part of a family of standards for the X.509 Public Key Infrastructure (PKI)... A certificate is a digitally signed data structure that binds a public key to a subject." This standard defines the structure of certificates managed by a PKI

whose central issuing entity is a CA (Certificate Server).

3. MIT OpenCourseWare

6.857 Computer and Network Security

Fall 2014

Lecture 15 Notes

"Web Security

SSL/TLS".

Section 2

"Certificates and PKI

" Page 2: The notes explain the need for a trusted third party

the Certificate Authority (CA)

to vouch for the binding between a name (e.g.

www.nettech.com) and a public key. This establishes the CA (Certificate Server) as the fundamental element for implementing a trusted public/private key system.