Digital certificate

Anyone can make up a private and public key combination and claim to be someone they are not. Before placing an order with an online merchant such as Amazon, you want to be sure it really is Amazon and not a spoofer. Digital certificates, and the supporting public key infrastructure, are an attempt to solve this problem of digital identity.

A digital certificate is a digital document issued by a trusted third-party institution known as a certification authority (CA). It contains the name of the subject or company, the subject's public key, a digital certificate serial number, an expiration date, an issuance date, the digital signature of the certification authority (the name of the CA encrypted using the CA's private key), and other identifying information.

In the United States, private corporations such as VeriSign, browser manufacturers, security firms, and government agencies such as the U.S. Postal Service and the Federal Reserve issue CAs. Worldwide, thousands of organizations issue CAs. A hierarchy of CAs has emerged, with less-well-known CAs being certified by larger and better-known CAs, creating a community of mutually verifying institutions. Public key infrastructure (PKI) refers to the CAs and digital certificate procedures that are accepted by all parties.

To create a digital certificate, the user generates a public/private key pair and sends a request for certification to a CA along with the public key. The CA verifies the information, issues a certificate containing the public key and other related information, then creates a message digest from the certificate and signs it with the CA's private key. When you sign into a 'secure' site, the URL begins with 'https' and a closed lock icon appears, meaning the site has a digital certificate issued by a trusted CA.