# Cryptosystems used to generate public key certificate

Where can we find the cryptosystems used to generate public key certificate? Are the cryptosystems under the signature algorithm and signature hash algorithm? Do I need to analyze the packets trasmitted between my computer and the server? For example, ciphersuite.

Suppose the following ciphersuites are transmitted from ClientHello to the server.

- TLS_RSA_WITH_AES_128_CBC_SHA256           (0x003c)
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256     (0xc027)
- TLS_ECDHE_ECDSA _WITH_AES_128_GCM_SHA256  (0xc02b)
- TLS_DHE_DSS_WITH_AES_128_CBC_SHA256       (0xc040)
- TLS_RSA_ WITH_RC4_128_MD5                 (0xc004)


Can I say that the cryptosystems used to protect the communication between my computer and the server are RSA, ECDHE_RSA, ECDHE_ECDSA and DHE_DSS?

• The question might not ask what you really mean, but in it's current form the answer is no. RSA, ECDHE_RSA, ECDHE_ECDSA and DHE_DSS are what's been used for the key exchange phase. For any authentication to happen a certificate needs to already have been generated. For example during RSA key exchange, secrets generated are encrypted with an RSA public key and the public key is checked to belong to the other party by verifying a certificate provided by a CA. – Edvard Fagerholm Nov 4 '14 at 7:25
• Then may i know where can I obtain the cryptosystems used to generate certificate? – Idonknow Nov 5 '14 at 2:45
• Either you have generated your public/secret key in your computer with your software and a CA sign your public key or a CA generates your public/secret key and further signs your public key. I think you are talking for the latter. – 111 Feb 6 '15 at 9:13

The ciphersuites only define the properties of the SSL channel that is to be created. The certificate - including the private key usage indicated in the certificate - should be consistent with the ciphersuite.

For instance if you have a ciphersuite starting with TLS_RSA then the certificate should allow encryption, and the public/private key should be RSA of course. If you have a TLS_DHE or TLS_ECDHE ciphersuite then the certificate should allow authentication with any supported authentication algorithm. Authentication is generally supported by the certificate of course, as that is the main use case for TLS certificates in the first place.

How the certificate was generated is outside the realm of TLS. Basically it doesn't care, as long as you can create a trust chain to a trusted certificate in the certificate store. For this it does need to be able to verify signatures though, so the algorithms used to sign certificates need to be supported.

The certificate is simply a file containing your public key (RSA or DSA) together with some information on e.g. how the public key is allowed to be used (for example only to authenticate a TLS connection to foo.yourdomain.com). Additionally, the file has been signed using either an RSA, DSA or ECDSA signature. Therefore, you should look up RSA/DSA/ECDSA signatures.