I understand a fair bit about keys in regards to what the private key does, and the public key for technologies such as PIV and GPG.
Where I get lost is how the certificate comes into play and what you're supposed to do with it.
For example, the private key is obviously yours and you use it to decrypt messages or files related to GPG that are sent to you. Your public key is what you give other people or upload to a public keyserver so that people can send you encrypted messages.
But aside from the public and private keypairs, there's also an option in software such as Kleopatra to generate a CSR for my GPG Keys.
- What is the purpose of generating that CSR if I have the private / public keys already.
- What do I do with that CSR if I do generate one? Do I hold on to it and keep it private like I would my private keys?
- What's the different between an x509 certificate that can be generated for PIV, and a certificate I can generate for GPG. Are they the same thing? x 509 certificate? Just different technologies use to generate them?
If you're confused about PIV, I'm referring to Yubikeys. They contain two interfaces that appear to do similar things: PIV and GPG.
And to clarify, I don't have a CA, I am generating a self-signed certificate.
And I guess the bonus question I have because I seem to be finding no clear answer, what's the difference between exporting a CRT, CSR, and say a PEM.
But some of the definitions don't register with me. Maybe over-complicated for my limited knowledge?