Allied Telesis AT-S60 - Manual (Page 506)

Chapter 24: Public Key Infrastructure (PKI)
Section V: Security Features 506
Root CA Certificates
A root CA must sign its own certificate. The root CA is the most critical
link in the certification chain, because the validity of all certificates
issued by any CA in the hierarchy depends on the root CA’s validity.
Therefore, every device which uses the root CA’s certificate must verify it
out of band.
Out-of-band verification involves both the owner of a certificate and the
user who wishes to verify that certificate generating a one-way hash (a
fingerprint) of the certificate. These two hashes must then be compared
using at least one non-network-based communication method.
Examples of suitable communication methods are mail, telephone, fax,
or transfer by hand from a storage device such as a smart card or floppy
disk. If the two hashes are the same, the certificate can be considered
valid.
Certificate
Revocation Lists
(CRLs)
A certificate may become invalid because some of the details in it
change (for example, the address changes), because the relationship
between the Certification Authority and the subject changes (for
example, an employee leaves a company) or because the associated
private key is compromised. Every CA is required to keep a publicly
accessible list of its certificates which have been revoked.