Validate the identity of the web server. server in order to prevent a malicious server from masquerading. validate the certificate of the root CA and any intermediate CAs. Manage encrypted HTTPS traffic using ISA server and web publishing. Used to decrypt and inspect traffic, then pass it to the web server using HTTP. Certificate on the ISA server. CA chain must be accessible from all potential web clients. Used to decrypt and inspect traffic, then re-encrypt and pass it to the web server using HTTPS/SSL. Certificate on the ISA server. Certificate on the web server. CA chain must be accessible from all potential web clients. Authenticate the SSL client. Prove the identity of the client when it connects to the web server. The use of this certificate is optional in SSL. Certificate on all potential web clients. Private key on the web client and public key available to the web servers. Code and document signing. Prove the identity of the distributor of that code or document, and prove that the code or document has not been changed since it was signed. Certificate at the point of code or document signature. All potential recipients must have access to the chain up to the root CA. System Center Configuration Manager 2007, running in native mode. With Configuration Manager, a site can be configured in native mode in order to secure communication between the site server, site roles, and the clients. Certificate on the site server and on all clients, to verify downloaded policies. Web server certificates on the following site system roles, for SSL communications: Management point Proxy management point Distribution point Software update migration point Client authentication certificates on all Configuration Manager clients Encrypting File System (EFS) EFS is a Windows encryption technology used to store encrypted files on NTFS file system volumes. Encrypted files cannot be used unless the user has access to the keys required to decrypt the information. Certificate on the encrypting machine. Certificate on the decrypting machine. Recovery key on a domain controller. Virtual Private Networks (VPNs) L2TP and SSTP VPNs can use certificates to encrypt traffic that is sent through the VPN connection. If PPTP VPN uses EAP-TLS for authentication, a certificate is required on each VPN server. CA chain must
authentication and encryption of traffic. server. Certificate is NOT required on the WAP server. For PEAP authentication: a certificate is required on each RADIUS server. S/MIME S/MIME is used as a standard for public key encryption and signing of email encapsulated in MIME. S/MIME is natively supported in Microsoft Office Outlook® and Outlook Web Access in Exchange Server with the S/MIME control. SSL can be used to encrypt email traffic as well as to validate the identity of the email server. For S/MIME signing: certificate on the sender. For S/MIME encryption: certificate on the recipient. For SSL encryption: certificate on each server. Windows Mobile devices Windows Mobile devices use certificates for encryption of traffic and optionally for authentication of the Exchange ActiveSync feature. For more information the certificate requirements for Windows Mobile, see “Choosing an Authentication Method for Your Exchange ActiveSync Server” at . For (optional) HTTPS/SSL encryption and authentication of the server: certificate on the server. To optionally authenticate the client, a certificate on each client that may connect.