I am trying to understand digital signatures and digital certificates. I know that digital certificates verify a server's public verification key but what does the website's (client) private verification key sign?

  • $\begingroup$ Are you asking that, in the context of web browsing, what does the private key of the server that hosts the website signs when some client makes a connection? $\endgroup$
    – DannyNiu
    Nov 12, 2022 at 7:36

1 Answer 1


What does the website's (client) private verification key sign?

When a standard browser connects to a website, that browser is the client, and typically has no public/private key pair. Thus there is no "website's client private verification key" to sign with.

In the following I consider a website with a single server, thus do no distinguish if a key or certificate is that of the website, or of the server.

What is a website's private signing key used to sign?

The website's private key, matching the public key signed by the website's certificate, is used by the website to sign a message incorporating a challenge generated by the browser, yielding a session-unique signature, that the browser verifies against the server's public key extracted from the server's certificate.

More in detail: In TLS 1.3, what's signed by the website is the transcript hash, which is a digest of some selected earlier exchanges† of the browser and the server, that both had an opportunity to influence with random seed they generated.

The browser somewhat gets the website's certificate (typically, from the server or from a cache); checks the signature of that certificate (typically thru a chain of certificates, perhaps obtained from the server, and from a local trusted database of ultimately trusted certificates‡ that came with the browser); perhaps checks that the certificate was not revoked; extracts the website's public key from the website's certificate; and verifies the signature in the Certificate Verify message of the server against that public key and the transcript hash jointly generated.

† Specifically: those of ClientHello, HelloRetryRequest, ClientHello, ServerHello, EncryptedExtensions, server CertificateRequest, server Certificate, server CertificateVerify, server Finished, EndOfEarlyData, client Certificate, client CertificateVerify, client Finished that have occurred.

‡ That list of ultimately trusted certificates is a serious weakness of the whole stuff, such that only a fool would trust TLS secure from state-level actors and other well-funded adversaries. For the latest (November 2022) account on (possibly) rogue certification authorities, see e.g. Bruce Schneier's blog article, or (while that works) the Washington Post article that AFAIK broke the story in the general press about that particular (possibly) rogue CA, with Joel Reardon.

  • $\begingroup$ So does the website use its private key signing key to sign the hash of the contents of the website so it can be viewed by anyone who has the website's public signature verification key? $\endgroup$
    – CryptoGuru
    Nov 12, 2022 at 14:42
  • 1
    $\begingroup$ No, it signs the transcript hash only. That doesn't contain the contents of the website, but rather of the key exchange. Then the exchanged symmetric key is used with Authenticated Encryption to send the contents of the web site, so the receiver both decrypts and verifies at the same time. $\endgroup$ Nov 12, 2022 at 18:11
  • $\begingroup$ Oh the transcript hash which is signed by the website contains the Diffie Hellman shared key (g^ab)? $\endgroup$
    – CryptoGuru
    Nov 12, 2022 at 18:51
  • $\begingroup$ @CryptoGuru, not the transcript hash doesn't contain $g^{ab}$, which is technically not part of the transcript. However, the (partial) transcript hash(es) is used together with $g^{ab}$ to derive the many keys used in TLS 1.3 (either to encrypt the handshake or other things). See here: datatracker.ietf.org/doc/html/rfc8446#section-7.1 $\endgroup$ Nov 12, 2022 at 21:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.