Explain the roles of `infinityca.key`, `infinityca.crt`, `conestoga.key`, `conestoga.csr`, and `conestoga.crt` in the described certificate-issuing workflow.

### What a good answer covers - Identify `infinityca.key` as the issuing authority's private key, used to sign the server certificate and protected by a passphrase in the described setup. - Identify `infinityca.crt` as the CA's self-signed certificate, which supplies the CA's public certificate information. - Distinguish `conestoga.key`, the server's secret private key, from `conestoga.csr`, which carries the public key, subject information, and proof-of-possession signature. - Explain that `conestoga.crt` is the CA-signed certificate created from the CSR, not a replacement for the server private key. ### The concept A certificate workflow uses separate keys for separate roles. The server keeps its private key and submits a signed request; the CA uses its own private key to issue a certificate that binds the server's identity to its public key. The CA certificate helps a relying party identify the issuer and obtain its public key for signature verification. The certificate does not contain the server's private key, so the server still needs `conestoga.key` when using the certificate. ### Terms - **CA**: Certificate Authority. The issuer that signs the server certificate. - **CSR**: Certificate Signing Request. A signed request containing the server's public key and subject details. ### Remember The server owns its key pair; the CA owns the signing key and issues the certificate.