0
$\begingroup$

A root certificate can be used to issue intermediate certificates.

The private key of the root certificate is needed in order to sign any intermediate certificates.

However, after that, we only need the public key of the root certificate to verify the signature of intermediate certificates.

Similarly, the private key of an intermediate certificate is needed to sign the public keys of SSL certificates issued by it but after that we no longer seem to need the private key of the intermediate certificate for anything other than issuing and signing more SSL certificates.

Does the private key of a CA certificate have any uses other than signing the certificates issued by it?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

It could be used to sign a Certificate Revocation List, for instance. Generally it is not used for anything other than certificate related actions, and some private keys belonging to root and intermediate certificates are therefore stored off-line to enhance security of the private key.

Improve this answer
$\endgroup$
3
  • $\begingroup$ So other than signing, it is usually not used for anything else, is that correct? $\endgroup$
    – Behrang Saeedzadeh
    Commented Nov 11, 2018 at 10:08
  • $\begingroup$ I mean in contrast to securing web servers where the private key and public certificate are both needed by the server, it looks like the private key of root/intermediate CAs are rarely needed in day to day operations unless if we want to create other intermediate CAs or SSL certificates and sign them (or as you have mentioned, to revoke them). $\endgroup$
    – Behrang Saeedzadeh
    Commented Nov 11, 2018 at 10:18
  • $\begingroup$ Generally you want to restrict key usage as much as possible. Having different keys for different purposes is beneficial, except possibly if you have to shell over too much $ for it. $\endgroup$
    – Maarten Bodewes ♦
    Commented Nov 11, 2018 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.