I'm confused about this section in my CEH security exam training material:

A CA is able to perform a number of roles in addition to the validation process outlined here. Some actions that a CA is called on to perform include the following:

Generation of the Key Pair - When a CA goes through the process of creating a certificate, a key pair that is made up of a public and private key is generated. The public key is made available to the public at large whereas the private key is given to the party requesting the digital certificate.

Can someone please explain this to me and perhaps include a practical example? I understand that a certificate authority would need to publish/distribute their public keys for root certs, but under what circumstances would I want a CA to distribute the public key for MY individual signed cert?

  • 2
    The language is vague: it does not say that the CA makes it public, just that the key is made public.
    – schroeder
    Dec 30, 2015 at 2:04
  • 1
    What exam is that? Dec 30, 2015 at 8:02
  • @StackzOfZtuff CEH.
    – Mike B
    Dec 30, 2015 at 17:23

2 Answers 2


Strictly viewed, it's not correct. It's not the CA that generates the public and private keys, but the requester. There's no reason the CA should have access to the private key. The private key should be kept private (though it's needed to establish every new secure connection, so it must be also on-line).

There's no point in keeping the public key hidden. By publishing the public keys, the CAs can increase the confidence level in the certificate itself, by giving another path to verify the identity. The purpose of public key cryptography is that there's no practical way to compute/impersonate the private key with only the public key accessible.

And, despite that, public keys/certificates are not published in all cases - for example, in the case of client certificates, assigned for user email addresses/persons, it might even be dangerous to publish all issued certificates.

On the other hand, publishing server certificates has the advantage that every other entity running servers can verify and confirm that noone else has issued a certificate to someone else for their name - this is actually a subject of a recent initiative called Certificate Transparency.

See - https://www.certificate-transparency.org/known-logs

Update: I agree that the quoted description is quite vague, and somewhat confusing.

Perhaps the poster misunderstood the same way, that the CA publishes any public key that it issues a certificate for. But it's not what it's about. What it appears to say, that when the CA initially creates its own certificate, with the public and private keys, it is then sharing that specific initial public key (well, not really, but the whole CA certificate) with the world "at large". This is the whole the point of a CA certificate - so that everyone finding a certificate issued by this specific CA will be able to verify it with a public key already available, in a way that no third parties can maliciously (at least not easily) interfere with.

  • Thanks for the clarification. This book I'm studying with leaves... much to be desired. :-/
    – Mike B
    Dec 30, 2015 at 17:23

The private key is used to decrypt messages encrypted with the public key, so anyone sending you a message will need access to the public key. The public key is also used to validate that any signatures from you were actually signed using your private key.

See https://en.m.wikipedia.org/wiki/Public-key_cryptography.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.