A Certificate Authority (CA) is creating a certificate for a server. Which key should the CA use to sign the server certificate?

### Why this is right The CA signs the issued certificate with its own private key. A relying system can then use the CA’s public certificate to check that signature and determine whether the certificate was signed by that CA. ### The concept A certificate binds identifying information, such as a server subject, to a public key. The CA’s signature protects that binding from undetected changes and provides evidence that the CA issued it. The server’s private key is separate: the server retains it and uses it in operations requiring its own key. A CA certificate commonly acts as a trust anchor when the verifier accepts that CA. ### The other options - **The server’s private key**: this key belongs to the server and is not used to issue the CA’s certificate signature. - **The CA’s public key**: a public key can be shared and used to verify signatures, but it is not the signing key. - **The server’s public key**: this appears in the server certificate, but it does not sign the certificate on behalf of the CA. ### Terms - **Certificate Authority (CA)**: An entity that issues certificates and signs them with its private key. - **Certificate**: A signed record that associates a subject with a public key. - **Private key**: A secret key that must be controlled by its owner and is used for signing or decryption, depending on the cryptographic operation. - **Public key**: A key that can be shared and used for operations such as signature verification. - **Trust anchor**: A certificate or key accepted as a starting point for deciding whether a certificate is trusted. ### Remember The CA’s private key signs issued certificates; the CA’s public key is used to check those signatures.