Certificates¶
A certificate is a file that contains both information about an organization and that organization's public key. The certificate uses a digital signature to associate or bind the public key with the identifying information about that organization. In addition to the organization information and public key, the certificate also contains information about who issued the certificate and what dates the certificate is valid for. If a certificate is issued by a trusted 3rd party certificate authority (CA) like VeriSign, DigiCert, GoDaddy, or Let's Encrypt, most modern browsers and Java virtual machines are configured to trust the certificate by default.
To obtain a certificate from a certificate authority, you first choose a certificate authority to use like VeriSign, DigiCert, GoDaddy, or Let's Encrypt. They then provide you with instructions on how to create your own private and public key set. From those keys, you generate a certificate request (.csr) that contains the public key and is generated with the private key. The certificate request is sent to the certificate authority but does not contain the private key. The certificate authority then return a signed certificate for you to provide to those that need your public key. If a certificate is owned and signed by the same organization, then it is called a "self-signed" certificate.
Certificates can be passed around and shared with anyone that you want. Since they contain the public key, think padlock, in addition to the organization information, the certificate can be used to both identify whose public key you are using as well as provide the actual public key itself. A widely used format for certificates is X.509. Consequently, sometimes a certificate is referred to as an X.509 certificate.
To view a certificate from a secure website, you can browse to the secure website in your browser and then click on the lock icon to view information about that website's certificate. You can then see what certificate authority issued the certificate; the date range the certificate is valid for; the signature encryption algorithm (SHA1 or other) and other details about the public key like type AES 128 or 256 bits, or RSA 1024 or 2048 bits, or other.