Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to understand the term end-entity. Does this term just mean anybody that plays a role in a PKI system that is not a CA? So if I request a certificate from A who is a CRL issuer for Verisign then am I an end entity to verisign? Is A?

share|improve this question
up vote 1 down vote accepted

An end-entity certificate is a certificate which is not used to validate signatures on other certificates, i.e. a certificate which does not contain a CA public key (its Basic Constraints extension is absent, or contains a cA flag with value FALSE). It is called "end-entity" because it appears, necessarily, at the end of a certificate path.

A CRL issuer certificate, i.e. a certificate for some entity who signs CRL (on behalf of a CA), can be an end-entity certificate, since signing CRL does not require to be a CA.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.