1
$\begingroup$

To get a public key of some organization or someone we want to send an encrypted message to, we need to make a request to CA asking that organization's public key. CA then returns X509 certificate. It contains CA's signature. To decrypt it we need to have a CA's public key. How can we securely obtain CA's public key?

Related:
- How can we get CA's public key?
- I've got my private key compromised. How does CRL work?
- What happens when a root CA has its private key compromised?

|improve this question
$\endgroup$
  • 1
    $\begingroup$ CA public keys are shipped with OS or applications like browsers. $\endgroup$ – CodesInChaos Nov 13 '13 at 15:25
  • $\begingroup$ If the CA cert is self signed (not cross-certified by any CA that is shipped with your OS or browser and thus trusted) then you have to obtain it by some means and to check if it is the original one. For instance, download it from some trusted location and check the hash value of the certificate (where the hash value is typically also published at the trusted location). $\endgroup$ – DrLecter Nov 13 '13 at 15:32
  • 2
    $\begingroup$ @CodesInChaos: make that an answer. $\endgroup$ – David Cary Nov 13 '13 at 15:55
1
$\begingroup$

You can search for root certificates of a given CA.

E.g.:

From there when you want to check a certificate you can check whether it belongs to/was signed by a root CA you trust. If you trust it, then you can get its public key.

More commonly as CodesInChaos said, trusted certificates are shipped with your OS/browser.

|improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.