I don't understand the flow of Digital Certificate with Email Encryption and Signing.

For Example, There is 2 users, Sender A and Receiver B.

  1. Is Certificate required to encryption to A or just private key is enough?
  2. How B decrypt email ? With the certificate of Sender ?
  • I suggest you edit this question, clarify it and fix the grammar. As it is, I can't make sense of it
    – Stephane
    Dec 5, 2013 at 9:30
  • @Stephane done :)
    – Johan Gelp
    Dec 5, 2013 at 9:41
  • That is a bit better. It's still not clear, though.
    – Stephane
    Dec 5, 2013 at 9:51

1 Answer 1


PKI-based signature and encryption works this way (in email and any other application):

  • When signing data, you need access to the private key
  • When validating signed data, you need access to the public key
  • When encrypting data, you need the public key
  • When decrypting data, you need access to the private key.

Now, a (X509) certificate is a set of data that contains (mostly):

  • Identity information
  • Usage limitation information
  • Public key data
  • Digital signature of all of the above by a certification authority (for allowing 3rd parties to decide whether or not trust this information).


  • For encrypting data all you need is the public key that matches the private key that will be used for decryption. In the case of email, that means access to the certificate of the recipient (an not the private key itself).
  • In order to decrypt data you always need access to the private half of the key used to encrypt it. In the case of email, it means that you need access to the private key linked to the public key contained in the recipient's certificate.

In the case of encryption, you do not and never need access to any part of keys belonging to the sending party. In fact, you do not actually need to have your own certificate or key pair to perform email encryption.

A personal certificate is only required when you intend to sign data or allow others to send you encrypted data.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .