There are a lot of different certificates. But how do they differ?

There are certificates for "code signing". Certificates for SSL websites. Why WWW certificates cannot be used for code signing? For me, certificate is certificate and has public and private key. And (i think) all certificates are the same. What are types of certificates (most common) and how do they differ so one can't be used for other activities?

Tried looking for comparision, but couldn't find any good source.


The simplest may be to quote RFC 5280, section Key Usage:

The key usage extension defines the purpose (e.g., encipherment,
signature, certificate signing) of the key contained in the
certificate. The usage restriction might be employed when a key that could be used for more than one operation is to be restricted.

There is also the Extended Key Usage section.

You will find lists of key usages in both sections. The key usage dictates what a given key can be used for. There are some fields needed based on the type of usage, but those could be set (or not) regardless.

As for why we don't just have one certificate to rule them all, you could craft a certificate allowing all uses, but that seems unwise. The general rule in privileges is to grant exactly what is needed and no more.

For example, most web servers need only Key Encipherment, Signing, and Server authentication and would not need Client authentication if they do not make use of it.

|improve this answer|||||
  • So, all those certificates are same, but have different "purpouse flags"? – Grzegorz Feb 14 '18 at 18:10
  • 1
    x509 certificates have specific key usages set. As I mentioned, other fields will be set depending on those uses (eg: Subject Alternative Name for servers), but otherwise the basic format is the same. For certificates that are not using x509, anything could happen. – Marc Feb 14 '18 at 18:14

Certificates != keys. Keys (really long bit strings with certain mathematical properties) can be used to encrypt, decrypt, and digitally sign (encrypt the hash of) documents.

Certificates contain various attestations and properties about the keys they include.

The certificate documents the purpose and origin of the key. The key is then used for whatever operation it is intended for, after the certificate is checked to be valid.

Keys can be of different strengths, and used with different ciphers.

As others have said, while you could use a particular key for multiple purposes, it is unwise to. the whole point of a certificate is to provide usage instructions to people and programs as to the proper, intended usage of a given key.

|improve this answer|||||
  • 1
    "digitally sign (encrypt the hash of)" - This is a dangerous misconception. See here. – AndrolGenhald Feb 14 '18 at 22:39
  • I sit corrected. @AndrolGenhald is correct on the specifics of signing. Given the nature of the question, I didn't think this detail was relevant to get in to when listing functions of keys to distinguish them from functions of certs. The exponentiation is the same operation, the padding is not. – JesseM Feb 14 '18 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.