Keep in the certificate and the correspondent keep bearer secure can be critical in some scenarios.
For example, if you use a certificate to perform content encryption of emails or documents and you'll
lose your public and private keys, you will not be able to access any data that is encrypted by using
the certificates public key.
This data can include, yeah, press, encrypted data and secure multipurpose internet mail extensions
protected emails.
Therefore, archival and recovery of public and private keys are important.
You can archive or backup your private key by exporting a certificate with a private key and storing
it in a secure location, such as an alternative media source or cloud based storage.
However, this approach requires that each user backup his or her private key, which user usually is
not a reliable backup method.
Another method is to centralize private key archival on the sea.
Please know that in regular operations, the CIA does not have access to a user's private key, as it
has generated on the client side.
Because of this, you must enable the archival of private key explicitly on each certificate template
where you want to have this functionality.
What are the conditions for a losing case you might lose case because of the following situations a
user profile is deleted or corrupted, CSP encrypts a private key and stores the encrypted private key
in the local file system and registry in the user profile folder.
Deletion or corruption.
Over the profile results in the loss of the private key material.
Another situation is when an operating system is the reinstalled when you reinstall the operating system.
The previous installations of the user profiles are lost and good and the private key material in this
scenario, the computer certificates are also lost.
Another situation is when a disk is corrupted, if a hard disk becomes corrupted and the user profile
is unavailable, the private key material is lost automatically.
In addition to the installed computer certificates.
And.
Another situation is when a computer is lost or stolen, if a user's computer is lost or stolen.
The user profile is a private key.
Material is also unavailable.
Blues know that losing a key player or a certificate is not always critical.
For example, if you lose a certificate used for digital sign or logging, you simply condition you
want, which will not affect any did.
However, lose on a certificate that was used for data encryption will result in the inability to.
To access data for that reason required and recovery is critical.
Also, talk about key archival and recovery agents to use private key archival, you must enable this
functionality on both the CIA and specific certificate templates, such as if this functionality is
not enabled by default on the C or on any certificate template to be able to archive private keys from
certificates.
You also must define the key recovery agent or K are a.
Gear Recovery Gear Coral on the Sea works from the moment that you fully configure it, it does not
apply, however, to the certificates that were issued before you enabled this functionality.
You use key archival and Kyra for data recovery in scenarios with a lost private key.
The.
Kerry is a user with the Kerry Kerry certificate who can decrypt private keys stores in an ADC database.
When you enable key archival on the C on certificate templates, each private key is encrypted with
a K or a public key and then stored in the C database as a result.
Correct carries private keys necessary for decrypting their private key on any user.
Caries.
Our users who can retrieve the original certificate, private key and public key that were used to encrypt
the data.
Do not confuse the KRG with a data recovery agent, the data recovery agent can decrypt your first encrypted
data directly when the original originating user's private key is not available.
Alternatively, the KRG does not decrypt any data directly.
It just decrypt archived private keys.
You will learn about data recovery agent functionality later in this section.
Now, to become a query, you must enroll a certificate that is based on the current query term template.
After all, this certificate is issued to the designated user a public key from the KAORU certificate
to as important all the see, which enables key archival.
From that moment, its certificate that is issued based on a template with enabled key archival will
be will have its private key stored in the C database and and grouped into the IS public key.
Here, recovery is a two phase process.
First, the certificate manager or C administrator, retrieves the encrypted file that contains the
certificate and private key from the CIA database.
Next query uses a private key to decrypt the private key from the encrypted file and then returns the
certificate and private key to the user.
Please know that for security reasons, it is the recommended the different people perform these two
phases by default to the KRG does not have permission to retrieve encrypted keys from a CIA database.
Those some words about security for key archival and survivor, it's about understanding key archival
and recovery.
When you have configured to to issue a query certificate, any user is prudent and wrote permission
of the KRG certificate template can and and become KRG members of the Domain Admin Center to represent
most groups receive permissions by default.
However, you must ensure that only trusted users are allowed to enroll for this certificate.
Also, you have to ensure that the care is private key is stored in a secure manner and the server.
Well, the keys are curved is is in a separate physical and secure location.
After the gay marriage certificate was issued, the TSA recommended that you remove this template from
the sea.
Also, it is recommended that you import the caries certificate only when a kill recovery procedure
is necessary.
No cure recovery implies that you can recover and recover the private key portion of a public private
key pair, private key recovery does not recover any data or messages.
It merely enables the user to retrieve lost or damaged keys and an administrator to assure the role
of a user for a data access or data recovery purposes.
In many applications, data recovery cannot cure without first performing gear recover.
The key to recovery procedure is as follows.
First, a user request a certificate from a see ID and provides a copy of the private key as part of
the request.
The syringe processes the request archives the encrypted private key in the CIA database and issued
a certificate to the requesting the user.
Second, an application such as Air First can use the issued certificate to encrypt sensitive files.
So if at some point the private key is lost or damaged, the user can contact.
The organization certificate manager to recover the private key, the certificate manager with the help
of the KRG, recovers the private key stored in a protected file format and then sends it back to the
to the user and force after the user stories.
The recovered private key and the user's local store and applications such as, you know, files can
assign can again use the key to decrypt previously encrypted files or to encrypt new ones.
Next up, we'll be talking about configuring automatic gear, will.