A Certificate Signing Request (CSR) contains the server’s private key so the Certificate Authority can use it to create the certificate.

### Why this is right The statement is false because a CSR contains the server’s public key and subject information, not its private key. The server signs the request with its private key to demonstrate possession of the matching key, but does not send that secret key inside the request. ### The concept A Certificate Signing Request (CSR) is a request for a certificate. It carries the public key that the future certificate should bind to the subject, along with identifying details. The server’s signature on the request gives the CA evidence that the requester can use the corresponding private key. This does not require disclosure of the private key. The CA checks the request and signs a certificate; the server keeps its private key for its own use. ### Watch out A signature made with a private key is not the same as placing that private key in the signed file. The CSR provides evidence of possession without revealing the secret. ### Terms - **Certificate Signing Request (CSR)**: A request containing a public key and subject information for a certificate to be issued. - **Certificate Authority (CA)**: An entity that checks certificate requests and signs issued certificates. - **Public key**: The shareable member of a public-key pair, included in a CSR and certificate. - **Private key**: The secret member of a key pair, retained by its owner. - **Subject information**: Identifying details included in a certificate request. ### Remember A CSR carries the public key, not the private key.