Fundamentals of InfoSecadvanced
Explain how a server certificate is requested, issued, and verified, and distinguish the roles of the server’s private key and the Certificate Authority’s private key.
Answer
The server generates a key pair and retains its private key. It creates a CSR containing its public key and subject information, and signs the request with its private key to show possession. The CA checks the request and signs the issued certificate with the CA’s private key. A verifier checks the certificate using the CA certificate, which must be trusted, and checks that the certificate details are suitable. The server’s private key remains with the server; the CA’s private key is used to issue certificates and must be protected.
Explanation
### Why this is right
A certificate request and a certificate have different roles. The server’s CSR asks the CA to certify a public key and subject, while the CA’s signature on the issued certificate records the CA’s approval of that binding. Verification checks the certificate signature against the CA’s public certificate, but trust also depends on accepting that CA and checking the certificate’s details.
### The concept
The server first creates a key pair and keeps the private part secret. It places the public key and subject information in a Certificate Signing Request (CSR), then signs the request with its private key to show that it controls the matching key. The CA checks the request and uses the CA’s own private key to sign the certificate. A verifier uses the CA certificate to check that signature. The two private keys must not be confused: one is used by the CA to issue certificates, and one belongs to the server. The server private key should not be handed to the CA or a customer.
### What a good answer covers
- The CSR contains public information, not the server’s private key.
- The server signs the CSR to show possession of the corresponding private key.
- The CA signs the issued certificate with the CA’s private key.
- Verification checks the signature and relies on a trusted CA certificate.
- Certificate suitability requires checking its identifying details and validity, not just its signature.
### Terms
- **Certificate Signing Request (CSR)**: A signed request for a certificate, containing a public key and subject information.
- **Certificate Authority (CA)**: An entity that checks requests and signs certificates.
- **Public key**: The shareable member of a key pair.
- **Private key**: The secret member of a key pair, retained by its owner.
- **Certificate verification**: Checking a certificate’s signature against a CA certificate and assessing whether it is trusted and appropriate.
### Remember
The server proves control of its key in the CSR; the CA’s own key signs the issued certificate.
Related Questions
- Explain why computer security is described as a process rather than a product. Include the roles of technology, people, and environment.(intermediate)
- Select ALL items the review identifies as possible security risks or losses.(intermediate)
- Arrange these broad security activities in a sensible cycle, beginning with identifying what needs protection.(intermediate)
- A security product can replace the continuing work of managing people, technology, and the operating environment.(intermediate)
- Which statement best captures the course review’s view of computer security?(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free