I always assumed that the process for getting a (trusted, not self-signed) certificate was more or less like this:
- You generate a public and private key pair
- From this key pair you generate a certificate
- You submit your public key, certificate and other (company) information to a CA
- The CA checks that the information you provided is correct
- The CA signs your certificate
However, lately I am doubting this. People told me that in fact the CA itself generates the public and private key pair and certificate and signs it and sends all of that to you... This would seem to me to be very insecure in the sense that all private keys of all certificates would be in the hands of just a few CA's.
I have been reading this question with a lot of interest: How do certification authorities store their private root keys?. However it only discusses the CA's own private keys.
So do the CA's have a copy of the private keys of the certificates they sign or not?