Certificate basics
How it works (PKI)
Digital certificates use PKI (Public Key Infrastructure), relying on a matched key pair for encryption and decryption. Each user holds a private key known only to them (for decryption and signing) and a public key shared with others (for encryption and signature verification).
To send confidential data, the sender encrypts with the recipient's public key and the recipient decrypts with their private key; the process is irreversible, so only the private key can decrypt. A user can also process data with their own private key to form a digital signature — since the private key is theirs alone, this proves the sender's identity, prevents repudiation, and lets the recipient detect tampering. Even knowing the plaintext, ciphertext and public key, deriving the private key is computationally infeasible; breaking a 2048-bit RSA key would take thousands of years with today's technology.
Applications
With the growth of the Internet, e-commerce and e-government, certificates are widely used for: accessing secure sites (server / SSL certificates), software authentication (code-signing certificates), secure email (personal email certificates), and online bidding, signing, ordering, document transfer, payments, tax filing, trading, shopping and customs declaration (personal signing and encryption certificates).
Problems it solves
Using public-key cryptography, certificates build a rigorous identity system that ensures: information is not stolen by anyone but sender and recipient; it is not altered in transit; the recipient can confirm the sender's identity; and the sender cannot repudiate what they sent. For an email certificate:
- Confidentiality: encrypt with the recipient's certificate so only they can read it; even a misdirected email cannot be opened by others.
- Integrity: signing with the sender's certificate confirms identity and reveals any tampering.
- Authentication: the sender's signature proves who they are, not an impersonator.
- Non-repudiation: only the sender holds their certificate, so they cannot deny sending a signed message.
Certificate authorities
Certificates are issued by a Certificate Authority (CA) — an authority that issues certificates to confirm user identity. To prevent forgery, the CA's public key must be trustworthy: it must publish its public key, or a higher-level CA provides a credential proving its validity, which gives rise to a multi-level CA hierarchy.
Issuance flow: the user generates a key pair and sends the public key plus identity details to the CA; the CA verifies identity, confirms the request genuinely came from the user, then issues a certificate containing the user's details and public key, signed by the CA; the user can then use it for secure activities.