Select ALL correct statements about the certificate workflow using a Certificate Authority (CA).

### Why this is right - The server generates and retains its private key, because the key is secret and belongs to the server. - The CSR contains the server’s public key and subject information, which the CA needs to prepare the certificate. - The CA’s private key signs the issued certificate, allowing verifiers with the CA’s public certificate to check the signature. - The CA’s certificate can serve as a trust anchor if the verifier accepts that CA. ### The concept A certificate workflow separates the server’s key pair from the CA’s key pair. The server’s public key is submitted for certification, while the server’s private key remains under the server owner’s control. The CA validates the request and signs a certificate binding the subject information to the submitted public key. A verifier checks the signature and also needs to decide whether the CA is trusted and whether the certificate details are appropriate for the intended connection. ### The other options - **The CA signs the issued server certificate using the server’s private key.**: The CA signs with its own private key. The server’s key proves possession during the request process and is retained by the server. ### Terms - **Certificate Authority (CA)**: An entity that issues and signs certificates. - **Certificate Signing Request (CSR)**: A request containing a public key and subject information. - **Private key**: A secret key retained by its owner. - **Public key**: A shareable key that can be included in a certificate. - **Trust anchor**: A CA certificate or key accepted as a trusted starting point for certificate validation. - **Verifier**: A system or person checking a certificate’s signature and trust. ### Remember The server owns its private key; the CA uses its own private key to issue the certificate.