Private keys, public keys, and digital certificates
Keys, digital certificates, and trusted certificate authorities establish and verify the identities of applications.
SSL uses public key encryption technology for authentication. In public key encryption, a public key and a private key are generated for an application. The data encrypted with the public key can be decrypted only with corresponding private key. Similarly, the data encrypted with the private key can be decrypted only by using the corresponding public key. The private key is password-protected in a key database file. Only the owner can access the private key to decrypt messages that are encrypted with the corresponding public key.
A signed digital certificate is an industry-standard method of
verifying the authenticity of an entity, such as a server, a client,
or an application. To ensure maximum security, a third-party certificate
authority provides a certificate. A certificate contains the following
information to verify the identity of an entity:
- Organizational information
- This certificate section contains information that uniquely identifies the owner of the certificate, such as organizational name and address. You supply this information when you generate a certificate with a certificate management utility.
- Public key
- The receiver of the certificate uses the public key to decipher encrypted text that is sent by the certificate owner to verify its identity. A public key has a corresponding private key that encrypts the text.
- Certificate authority's distinguished name
- The issuer of the certificate identifies itself with this information.
- Digital signature
- The issuer of the certificate signs it with a digital signature to verify its authenticity. The corresponding CA certificate compares the signature to verify that the certificate is originated from a trusted certificate authority.
Web browsers, servers, and other SSL-enabled applications accept
as genuine any digital certificate that is signed by a trusted certificate
authority and is otherwise valid. For example, a digital certificate
can be invalidated for the following reasons:
- The digital certificate expired.
- The CA certificate that is used to verify that it is expired.
- The distinguished name in the digital certificate of the server does not match with the distinguished name specified by the client.