My requirement is signing the message with private key on one side and verifying it on other side using public key. SHA256, rsa:2048 are the algorithms i need to use. May i know whether X.509 is needed for my requirement if yes what is its role during signature generation and verification ?


1 Answer 1


X509 is a set of standards for a whole bunch of Public Key Infrastructure stuff. Usually, when people refer to X509, they mean certificates since X509 is the widely accepted format for certificates.

So, I will interpret your question as:

what is the role of certificates during signature generation and verification?

Short Answer:

There's no technology reason why you need a certificate. You sign something with your private key, someone else verifies it with your public key, done. The problem that certificates solve is getting your public key to the recipient without an attacker being able to put in their own public key instead.

Longer Answer:

Let's say you have a private key and the corresponding public key. You sign a message with the private key. You want somebody else to be able to verify your signature. Well they need your public key in order to do that. The question is: how do you get your public key to them without it getting intercepted and replaced by an attacker's public key? This is known as the key distribution problem. If you have a way to do that, like a GPG Public Key Server, or an internal corporate network share then you don't need certificates at all.

But if you need to send your public key over an insecure method, like email, then having a Certificate Authority make a certificate for your public key ensures that no attacker can do a man-in-the-middle and replace your public key with their own.

  • I have a similar problem. I have a system which receives some payload from a third party application via an API endpoint. The payoad is getting signed using a X509 Certificate(Private Key). How do I verify the request is being signed using their public Key at my application side. Is there any way to do this via Apache. Please refer my detailed question- security.stackexchange.com/questions/139207/… Commented Oct 9, 2016 at 5:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .