2
$\begingroup$

I have some problems to understand the storage of my private key when a CA generates my key pair. Let's assume the CA creates my key pair, issues the certificate with my public key and signs it with the corresponding private key. So MY private key is first stored at the CA and after issuing of my certificate I will get my private key? Is that right?

$\endgroup$
7
$\begingroup$

Typically you send a Certificate Signing Request (CSR) to the CA. The CSR contains everything you want to be inside your certificate, including your public key. The CA takes a look, and if it likes it, creates a certificate and signs it and sends it back to you. The CA never has to see your private key.

$\endgroup$
  • $\begingroup$ So the signing key (private) must not be the corresponding key to the public key in my certificate? Okay, now I unterstand! EDIT: What if the CA generate my key pair? How do I get my private key? $\endgroup$ – Eric M. Jul 8 '17 at 17:04
  • 3
    $\begingroup$ @Eric-M If the CA generated your key-pair then you should probably change CA. No self-respecting CA will ever generate your keys. Nobody other than you should ever see your private key. $\endgroup$ – Rukako Jul 8 '17 at 17:08
  • 1
    $\begingroup$ @Eric M I think there is confusion here. Your certificate is signed by the CA's private key, not your own. That way, anybody with the CA's public key can verify your certificate. $\endgroup$ – user13741 Jul 8 '17 at 17:10
  • $\begingroup$ Okay, thank you both! I thought that the signing key has to be the corresponding public key in the certificate. $\endgroup$ – Eric M. Jul 8 '17 at 17:11
  • 1
    $\begingroup$ @EricM. that is the case in a "self-signed" certificate. (And for normal CA-certs, the CSR itself is also signed by your private key, to prove that you actually own it.) $\endgroup$ – Paŭlo Ebermann Jul 8 '17 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.