I'm new to public key infrastructure but I think I understand how public key encryption works, conceptually. So a public key is, by definition, public and not a secret.

Recently when I came across the term identity certificate and read about it, it sounded very similar to the public key of an entity. But, it was not explicitly stated whether they are the same or different.

My questions are:

  1. Is an identity certificate same as a public key? If no, then is an identity certificate considered a secret?

  2. How are they related?

  • 1
    in case you are referring to X.509 certificates, they are containers for public key. they contain identity information along with the public key.
    – Shurmajee
    May 19, 2020 at 4:52
  • Yes I didn't know about the containment relation.
    – pnvn
    May 19, 2020 at 21:43

2 Answers 2


Is identity certificate same as public key?

No, a certificate contains a public key but is not the public key itself.

If no, then is identity cert considered a secret?

Usually not, it usually contains only information not considered secret.

How are they related?

A certificate is the public key of an identity together with more information about the identity and usage restrictions. All together is then signed by the certificate issuer.

Which identity information are included depend on the specific use case but usually contain state, country, organization, name, maybe email, ... . Usage restrictions contain the time period when the certificate is valid, if it can be used for signing, if it is a TLS server or client certificate or a certificate authority (CA) etc. The signature by the certificate issuer is needed to protect the information in the certificate against tampering and also to create a trust infrastructure which can later be used to verify the certificate - see wikipedia: Public Key Infrastructure for more on this.


Steffen Ullrich gave a good answer.

I would just add a few more points.

The main idea of certificate is that there is some party (called CA - Certification Authority) that is trusted by all PKI participants, which confirms the ownership of the public key. You can interpret certificate as statement: "We, the CA, confirm, that this public key belongs to person (or company) X". And this statement is signed by the CA.

You generate a key pair. You send your public key to the CA and ask them to confirm that you are the owner of this public key. The CA verifies your person (depending on certificate type it can be from very simple check to more complex set of checks) and issues a certificate, that confirms that you are the owner of the public key contained in this certificate. This certificate is signed by CA and thus neither you nor anyone else can fake such certificate.

The certificate is not secret. Vice versa. everywhere where you are asked to confirm your identity, you provide this certificate. E.g. if you have an S/MIME certificate and sign an email (using corresponding private key), the certificate is attached to the email, and then the receiver can read the certificate, see the signature of CA and can be sure, that the Email is really from you.

What is secret is your private key. You should keep it secretly, because if smb. gets access to it, he can e.g. encrypt messages or sign documents in your name, and you cannot object that it was not you. In case you think your private key was stolen, you can declare it as invalid. Then your CA will put your certificate to a so called revocation list. Everyone who verifies your certificate will see that it is not valid any more and will not trust it.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .