Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return.

What I don't understand is what, exactly, Verisign does with the CSR file? In the event that I lose the x509 certificate sent by them, will they be able to generate another?

2 Answers 2


What Verisign does, basically, is to encrypt your certificate using their private key, and send you the result. The user's browser contains Verisign's public key, so it can verify your key has been signed by Verisign by decrypting it using that public key.

They can re-send you your certificate as often as you want (they may or may not choose to do so commercially, but there's no security reason why they shouldn't). What they can't re-create for you is the private key that you used to generate the certificate and that must be installed on all of your web servers -- if you lose that, you have to get a new certificate starting from scratch.

  • Thanks for answering. However I was reading a slide on SSL, where the author mentioned CA should not resend the cert. I could not understand why. Commented Jun 10, 2012 at 12:44
  • It's technically not encrypting with private key then decrypting with public key, it's a little different to get the algorithm to work, though the idea is there (this is why El-Gamel and DSA are named differently in the PGP world, not just under the one name banner).
    – ewanm89
    Commented Jun 10, 2012 at 12:57
  • 1
    @NoviceUser: I can't imagine why either. There's no reason the cert needs to be secret. Commented Jun 11, 2012 at 8:48

To get a certificate signed, you send to the CA a Certificate Signing Request, which is something like an incomplete certificate. The CA then generates a certificate to sign, using as much or as little information from the CSR as the CA decides to include, based on the CA's policies, the type of certificate you purchased, etc. The generated certificate always includes the public key from the CSR, though, and usually contains the same name from the CSR as well.

Both the certificate and the CSR are defined by the X.509 spec, so saying "x509" doesn't narrow things down beyond that.

But as a rule the only thing you send to the CA is the CSR. They don't need anything else and don't have any use for anything else. You certainly don't send them the private key -- the whole signing process was built around the idea that you don't share the private key with anyone, ever. The private key is created at the same time as the CSR, but is kept private, while the CSR is sent to the CA, who gives you a certificate back in exchange. The public key listed in the certificate will match the private key you created when you created the CSR.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .