SSL Certificate - What is the use of the private key in a root certificate?

Question

I am new to Cryptogrphy, HTTPS and SSL !!! If i am not wrong , the private key of an End Entity certificate (certificate issued by trusted CA like Verisign) is used to decrypt the information sent by the client ! But does a root certificate also have a Private Key?

If Yes, then I wanted to know where exactly the private key of a root certificate is used? What happens if it is leaked ?

score 1 · Accepted Answer · answered Jun 23 '13 at 22:01

1

If I am not wrong, the private key of an End Entity certificate (certificate issued by trusted CA like Verisign) is used to decrypt the information sent by the client

You are wrong. It isn't. The peer's own private key is used to sign the certificate so the client can verify that the peer owns the certificate he presents, and the private key of signing certificates is used to, err, sign certificates.

answered Jun 23 '13 at 22:01

user207421

305,947
44
307
483

I assume that by "peer" you are referring to the holder of the End entity certificate. – user2048204 Jun 24 '13 at 08:39
@user2048204 The signature is computed over the entire certificate chain that he sends, actually, and a few other things too, but the signature is sent separately. It's. It the same thing as the signature *in* the certificate, which is computed by the signing CA. – user207421 May 12 '14 at 18:24

score 0 · Answer 2 · answered Jun 23 '13 at 16:38

0

The root certificate's private key is (normally) only used to sign the intermediate certificates. Compromising it allows you to create new intermediate certificates, and by extension, certificates for any domain.

answered Jun 23 '13 at 16:38

Colin Valliant

1,899
1
13
20

Ok , so can i say that Every certificate has a digital signature, and this digital signature is created by using the Private Key of its Issuing Certificate? – user2048204 Jun 23 '13 at 17:12

score 0 · Answer 3 · answered Jun 23 '13 at 16:39

0

A root certificate is the top-most certificate of the tree, the private key of which is used to "sign" other certificates. All certificates immediately below the root certificate inherit the trustworthiness of the root certificate - a signature by a root certificate is somewhat analogous to "notarizing" an identity in the physical world. If you knew the private key, you could create new (counterfeit) certificates.

answered Jun 23 '13 at 16:39

djf

6,592
6
44
62

Ok , so can i say that Every certificate has a digital signature, and this digital signature is created by using the Private Key of its Issuing Certificate? – user2048204 Jun 23 '13 at 17:09

SSL Certificate - What is the use of the private key in a root certificate?

3 Answers3