I know that in order to get a certificate, one needs to issue a Certificate Signing Request, which is eventually a X509 file, and pass it somehow to the signing CA. But I was wondering, how does this process actually work? Is it completely automatic? This sound weird - shouldn't the CA make at least a phone call to the company it's issuing a certificate for to see that it is legitimate?

  • That depends. If all you care is that the entity making the request for example.com can prove ownership over example.com, then the process can be (and nowadays usually is) completely automatic.
    – MechMK1
    Dec 13 '21 at 22:08

Browse other questions tagged or ask your own question.