For applications not involving CA signed certificates – or web browsers for that matter – it would seem to be easier to use a raw key pair if possible, rather than deal with potential formatting issues later on. I know they contain metadata and permissions (not sure how the permissions are actually enforced).

Is there any reason to use a certificate over a key pair?

  • $\begingroup$ Question is a bit broad. A key pair / certificate to do what? Sign things? Encrypt things? SSH into machines? $\endgroup$ – puzzlepalace Apr 4 '18 at 21:58
  • $\begingroup$ This would be for signing in this case, but I didn't want to discourage answers for both. Please make suggestions for both. Thanks! $\endgroup$ – user8897013 Apr 4 '18 at 22:16
  • $\begingroup$ Well, it got a plus one, so I guess it has to stay. For my purposes, the infrastructure ended up dictating certificates. This seems to be the standard for non-ssh tasks, and required by openssl as well (I think). $\endgroup$ – user8897013 Apr 5 '18 at 0:26
  • $\begingroup$ Note there are many uses of HTTPS other than browsers, and many uses of SSL/TLS other than HTTPS, and both groups effectively require X.509 certs (since approximately nobody uses 7250). You appear to mean non-SSL/TLS, but even that is a wide range. You're right SSH is the most common use of bare keys. PGP uses what actually are (very-non-X.509) certs but (mostly) without CAs to sign them and avoiding the name. $\endgroup$ – dave_thompson_085 Apr 5 '18 at 4:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.