I am beginner in cryptography and now I try to understand certificate process.
I read this answer and have some questions about the enrollment process:
The general procedure to issue certificates in a Public Key Infraestructure is moreless the following.
1) the client generates a key pair, private and public
2) the client generates a CSR (Certificate Signing Request) including attributes like Common Name and the Public key. Signs it with the private key and sends it to the server
3) The server builds the X509 Certificate with the CSR data, sins it with the CA private key and returns the X509 to client
4) the client stores the private key and the certificate in a KeyStore
- It's not clear to me when client encrypt CSR (Certificate Signing Request) by client's private key and send to CA server ---> How the Server can read this CSR?
- The CA server build X.509 and sign with CA private key. If I have client B, how client B get client A public key?
- I wrote the code in Android to generate RSA key pair. Next step, what should I do to get certificate from CA server?
- About CA server, I find two open source: OpenCA and EJBCA. What should I choose?
I am not clear about this. Thanks in advance.