Skip to main content
Information Security

Return to Answer

replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

A server can use a self-signed certificate to identify itself. Clients then have to trust this certificate when they connect or use the server's service.

In PKI infrastructure you normally don't have the CA generate the key-pair unless its the root certificate. Clients and intermediate CAs will generate their own key-pair and use the CSR to have the root certificate sign it. A CA doesn't generate certificates itself because then how can you trust that the CA hasn't kept the private key for itself. This breaks down the PKI infrastructure.

CAs like Symantec/Verisign or GoDaddy generally don't offer services to generate the key-pair for you. Due to reasons in the previous paragraph. You send them a CSR with the information for your certificate to be signed.

See my answer heremy answer here for more details.

A server can use a self-signed certificate to identify itself. Clients then have to trust this certificate when they connect or use the server's service.

In PKI infrastructure you normally don't have the CA generate the key-pair unless its the root certificate. Clients and intermediate CAs will generate their own key-pair and use the CSR to have the root certificate sign it. A CA doesn't generate certificates itself because then how can you trust that the CA hasn't kept the private key for itself. This breaks down the PKI infrastructure.

CAs like Symantec/Verisign or GoDaddy generally don't offer services to generate the key-pair for you. Due to reasons in the previous paragraph. You send them a CSR with the information for your certificate to be signed.

See my answer here for more details.

A server can use a self-signed certificate to identify itself. Clients then have to trust this certificate when they connect or use the server's service.

In PKI infrastructure you normally don't have the CA generate the key-pair unless its the root certificate. Clients and intermediate CAs will generate their own key-pair and use the CSR to have the root certificate sign it. A CA doesn't generate certificates itself because then how can you trust that the CA hasn't kept the private key for itself. This breaks down the PKI infrastructure.

CAs like Symantec/Verisign or GoDaddy generally don't offer services to generate the key-pair for you. Due to reasons in the previous paragraph. You send them a CSR with the information for your certificate to be signed.

See my answer here for more details.

added 105 characters in body
Source Link
RoraΖ
RoraΖ
  • 12.5k
  • 4
  • 54
  • 84

A server can use a self-signed certificate to identify itself. Clients then have to trust this certificate when they connect or use the server's service.

In PKI infrastructure you normally don't have the CA generate the key-pair unless its the root certificate. Clients and intermediate CAs will generate their own key-pair and use the CSR to have the root certificate sign it. A CA doesn't generate certificates itself because then how can you trust that the CA hasn't kept the private key for itself. This breaks down the PKI infrastructure.

CAs like Symantec/Verisign or GoDaddy generally don't offer services to generate the key-pair for you. Due to reasons in the previous paragraph. You send them a CSR with the information for your certificate to be signed.

See my answer here for more details.

A server can use a self-signed certificate to identify itself. Clients then have to trust this certificate when they connect or use the server's service.

In PKI infrastructure you normally don't have the CA generate the key-pair unless its the root certificate. Clients and intermediate CAs will generate their own key-pair and use the CSR to have the root certificate sign it. A CA doesn't generate certificates itself because then how can you trust that the CA hasn't kept the private key for itself. This breaks down the PKI infrastructure.

CAs like Symantec/Verisign or GoDaddy generally don't offer services to generate the key-pair for you. Due to reasons in the previous paragraph. You send them a CSR with the information for your certificate to be signed.

A server can use a self-signed certificate to identify itself. Clients then have to trust this certificate when they connect or use the server's service.

In PKI infrastructure you normally don't have the CA generate the key-pair unless its the root certificate. Clients and intermediate CAs will generate their own key-pair and use the CSR to have the root certificate sign it. A CA doesn't generate certificates itself because then how can you trust that the CA hasn't kept the private key for itself. This breaks down the PKI infrastructure.

CAs like Symantec/Verisign or GoDaddy generally don't offer services to generate the key-pair for you. Due to reasons in the previous paragraph. You send them a CSR with the information for your certificate to be signed.

See my answer here for more details.

Source Link
RoraΖ
RoraΖ
  • 12.5k
  • 4
  • 54
  • 84

A server can use a self-signed certificate to identify itself. Clients then have to trust this certificate when they connect or use the server's service.

In PKI infrastructure you normally don't have the CA generate the key-pair unless its the root certificate. Clients and intermediate CAs will generate their own key-pair and use the CSR to have the root certificate sign it. A CA doesn't generate certificates itself because then how can you trust that the CA hasn't kept the private key for itself. This breaks down the PKI infrastructure.

CAs like Symantec/Verisign or GoDaddy generally don't offer services to generate the key-pair for you. Due to reasons in the previous paragraph. You send them a CSR with the information for your certificate to be signed.