What is the purpose of a public key certificate?

Question

1) Imagine Alice wants to begin an secure conversation over the network with Bob.   She send Bob her public key certificate (which contains her public key). But since her certificate is indeed public, how can Bob verify that it's really Alice's certificate and not a forgery by someone who wishes to impersonate Alice?

2) What is the purpose of a public key certificate? That is, what security function does it perform?

3) What is a Certification Authority (in the context of Public Key Cryptography)?

Answer 1

Hi Sarah,

To help answer this question, I'm going to break down what a public key certificate is...

A public key certificate contains several fields, including:

1. Issuer - The issuer is the Certificate Authority (CA) that issued the certificate. If a user trusts the CA that issues a certificate, and if the certificate is valid, the user can trust the certificate.
2. Period of Validity - A certificate has an expiration date, and this date is one piece of information that should be checked when verifying the validity of a certificate.
3. Subject - The subject field includes information about the entity that the certificate represents.
4. Subject's public key - The primary piece of information that the certificate provides is the subject's public key. All the other fields are provided to ensure the validity of this key.
5. Signature - The certificate is digitally signed by the CA that issued the certificate. The signature is created using the CA's private key and ensures the validity of the certificate. Because only the certificate is signed, not the data sent in the SSL transaction, SSL does not provide for non-repudiation (a sender denying that they sent the data).