An administrator follows an instruction to send a customer both the issued server certificate and the server’s private key. Explain the security problem and state what should normally be shared and what should remain secret.

### Why this is right A private key is intended to be controlled only by its owner. Sending the server’s private key to a customer expands who can access it and can undermine the identity and security that the certificate is meant to support. The certificate is different: it contains public information, including the server’s public key, and is the item that can be distributed for use or inspection. ### The concept A public-key pair has a public part and a private part. The certificate records the public key and identifying information, while the private key remains separate. In the supplied workflow, Apache is configured with paths to both the certificate and the server private-key file, so the server needs access to the private key locally. The CA’s private key is also sensitive because it signs issued certificates. The instruction to send the private key to the customer should therefore be treated as unsafe; the customer may receive the certificate, but not the server’s secret key. ### What a good answer covers - The server private key must remain secret and controlled by the server owner. - Sharing it can enable misuse of the server’s cryptographic identity. - The server certificate contains public information and may be distributed. - The CA private key is also secret and must be protected. ### Watch out The certificate and private key are often used together by a server, but that does not mean they have the same distribution rules. ### Terms - **Private key**: A secret key that must remain under its owner’s control. - **Certificate**: A signed record containing a subject’s public key and identifying information. - **Public key**: The shareable part of a key pair. - **Apache**: Web server software that can be configured to use a certificate and corresponding private key. - **Impersonation**: Pretending to be another system or identity. ### Remember A server may need both files locally, but only the certificate is meant to be shared.