0

Several sites, like this states that

You can obtain a digital signature from a reputable certificate authority such as Sectigo

But digital signature is something you create using a piece of text and your private key using a signing algorithm. How can I obtain a digital signature from a CA? Shouldn't I just be receiving the digital signing certificate from the CA and creating the digital signature by myself?

2
  • Yes, and the link you provided says exactly that. The only confusing bit to that whole page appears to be that one sentence. Is there another place that says the same? I think it's just a typo and they meant to say "you can obtain a digital certificate" since the next line is talking about certificates.
    – schroeder
    Jul 3 '20 at 7:15
  • I googled the phrase and it appears that several small companies have copy/pasted the same basic page for themselves. It's just a typo that people have been blindly copying.
    – schroeder
    Jul 3 '20 at 7:22
1

It's a typo.

They meant to say "you can obtain a digital certificate" since the next line is talking about certificates. And the rest of the page sets up the correct understanding of how the process works.

I googled the quote you provided and it appears that several small companies have copy/pasted the same basic page for themselves. It's just a typo that people have been blindly copying.

3

It is a bit oversimplified and mixed together here.

We need to distinguish a few things:

  1. The CA issues a digital certificate with a digital signature to you
  2. You can use the signed digital certificate to sign other data (depending on the certificate, that can be TLS handshakes, e-mail signatures and so on).

You can obtain a digital signature from a reputable certificate authority such as Sectigo

What they mean here is that a certificate authority takes your certificate signing request (CSR), adds or removes certain fields from it, puts it into a slightly different format (a "to be signed certificate") and adds a digital signature to it, which makes it a valid, trusted X.509v3 certificate that you can use to sign other things.

Shouldn't I just be receiving the digital signing certificate from the CA and creating the digital signature by myself?

Yes, this is exactly how it works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.