To get a public key of some organization or someone we want to send an encrypted message to, we need to make a request to CA asking that organization's public key. CA then returns X509 certificate. It contains CA's signature. To decrypt it we need to have a CA's public key. How can we securely obtain CA's public key?

- How can we get CA's public key?
- I've got my private key compromised. How does CRL work?
- What happens when a root CA has its private key compromised?

  • 1
    $\begingroup$ CA public keys are shipped with OS or applications like browsers. $\endgroup$ Commented Nov 13, 2013 at 15:25
  • $\begingroup$ If the CA cert is self signed (not cross-certified by any CA that is shipped with your OS or browser and thus trusted) then you have to obtain it by some means and to check if it is the original one. For instance, download it from some trusted location and check the hash value of the certificate (where the hash value is typically also published at the trusted location). $\endgroup$
    – DrLecter
    Commented Nov 13, 2013 at 15:32
  • 2
    $\begingroup$ @CodesInChaos: make that an answer. $\endgroup$
    – David Cary
    Commented Nov 13, 2013 at 15:55

1 Answer 1


You can search for root certificates of a given CA.


From there when you want to check a certificate you can check whether it belongs to/was signed by a root CA you trust. If you trust it, then you can get its public key.

More commonly as CodesInChaos said, trusted certificates are shipped with your OS/browser.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.