Title: Certificate Creation
Course: Introduction to SSL/PKI > Section: PKI

Certificate Creation

Introduction

The following diagrams show how PKI certificates are created by a Certificate Authority (CA) and made available to others.

What Does a Certificate Authority Do?

A Certificate Authority (CA) issues certificates binding a public key to a particular Distinguished Name (DN) in a directory, and/or to an alternative name such as an e-mail address or a DNS-entry.

Certificate Creation 1

Alice wants to create a PKI certificate (key pair) so people can send her private messages.

Certificate Creation 2

Using her computer, Alice creates a key pair. The encryption key is the public key.

Note: The Certificate Authority (CA) does not create keys. (This is a big simplification. The CA can end up with a copy of the encryption key so data can be recovered if the user looses the ley.)

Certificate Creation 3

After creating a key pair, Alice create a Certificate Signing Request (CSR) containing the public encryption key and other information.

Alice then sends the CSR to a trusted Certificate Authority (CA).

Certificate Creation 4

The Certificate Authority (CA) creates a certificate from the Certificate Signing Request (CSR) sent by Alice. It contains Alice's public key and other information. The CA signs the certificate so others can validate the certificate.

The CA then returns the certificate to Alice. It also copies the certificate to a public location so others may find and use it.