Which key signs the server certificate when the Certificate Authority (CA) issues it?

### Why this is right The issuer signs the certificate with its own private key. A verifier can then check that signature using the issuer's public key, which is available through the CA certificate or a trusted certificate chain. ### The concept A certificate binds subject information to a public key and includes an issuer's digital signature. The server generates and retains its private key; the CA uses its separate private key to sign the server's certificate. This distinction allows clients to check that the certificate was issued by the CA without the CA revealing its signing key. ### The other options - **A. The server's private key**: the server uses this to sign its CSR and prove possession, not to issue the CA-signed certificate. - **B. The server's public key**: public keys are used to verify signatures or support cryptographic operations, not to make the CA's signature. - **D. The CA's public key**: this is shared so signatures can be verified; it cannot create the CA's signature. ### Terms - **CA**: Certificate Authority. The issuer that signs a certificate. - **CSR**: Certificate Signing Request. The request the server signs with its own private key. ### Remember The issuer signs with its private key; recipients verify with the corresponding public key.