Skip to main content
Information Security

Return to Answer

added 1 character in body
Source Link
M'vy
M'vy
  • 13.1k
  • 3
  • 49
  • 70

The basic protocol for getting a singed certificate from a CA is the following:

  • Requester generates a key pair (a private key and a public key)
  • The private key is put aside and should never leave the computer
  • Requester generates a Certificate Signing Request (CSR) which contains basic information that will go into the final certificate (Distinguished Name, Country, ...)
  • Requester submits the CSR to the CA which will verify it (eventually contact the requester to establish it's identity)
  • When the CA trusts the CSR belongs to the identified person, the CA will issue a certificate which is basically the CSR signed by the CA's publicprivate key (plus some information to track the signature back to the CA)
  • The requester can now use the certificate which embeds it's public key signed by the CA to establish communication with clients.

So when importing the signed certificate, you should not have to create any private key (you should already have it). It is also good to know that many program managing key generation will also propose to put the private key into a secured file. This file will be encrypted (AES probably) with a passphrase you should supply.

The basic protocol for getting a singed certificate from a CA is the following:

  • Requester generates a key pair (a private key and a public key)
  • The private key is put aside and should never leave the computer
  • Requester generates a Certificate Signing Request (CSR) which contains basic information that will go into the final certificate (Distinguished Name, Country, ...)
  • Requester submits the CSR to the CA which will verify it (eventually contact the requester to establish it's identity)
  • When the CA trusts the CSR belongs to the identified person, the CA will issue a certificate which is basically the CSR signed by the CA's public key (plus some information to track the signature back to the CA)
  • The requester can now use the certificate which embeds it's public key signed by the CA to establish communication with clients.

So when importing the signed certificate, you should not have to create any private key (you should already have it). It is also good to know that many program managing key generation will also propose to put the private key into a secured file. This file will be encrypted (AES probably) with a passphrase you should supply.

The basic protocol for getting a singed certificate from a CA is the following:

  • Requester generates a key pair (a private key and a public key)
  • The private key is put aside and should never leave the computer
  • Requester generates a Certificate Signing Request (CSR) which contains basic information that will go into the final certificate (Distinguished Name, Country, ...)
  • Requester submits the CSR to the CA which will verify it (eventually contact the requester to establish it's identity)
  • When the CA trusts the CSR belongs to the identified person, the CA will issue a certificate which is basically the CSR signed by the CA's private key (plus some information to track the signature back to the CA)
  • The requester can now use the certificate which embeds it's public key signed by the CA to establish communication with clients.

So when importing the signed certificate, you should not have to create any private key (you should already have it). It is also good to know that many program managing key generation will also propose to put the private key into a secured file. This file will be encrypted (AES probably) with a passphrase you should supply.

Source Link
M'vy
M'vy
  • 13.1k
  • 3
  • 49
  • 70

The basic protocol for getting a singed certificate from a CA is the following:

  • Requester generates a key pair (a private key and a public key)
  • The private key is put aside and should never leave the computer
  • Requester generates a Certificate Signing Request (CSR) which contains basic information that will go into the final certificate (Distinguished Name, Country, ...)
  • Requester submits the CSR to the CA which will verify it (eventually contact the requester to establish it's identity)
  • When the CA trusts the CSR belongs to the identified person, the CA will issue a certificate which is basically the CSR signed by the CA's public key (plus some information to track the signature back to the CA)
  • The requester can now use the certificate which embeds it's public key signed by the CA to establish communication with clients.

So when importing the signed certificate, you should not have to create any private key (you should already have it). It is also good to know that many program managing key generation will also propose to put the private key into a secured file. This file will be encrypted (AES probably) with a passphrase you should supply.