Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When using Apache with SSL, does the entire certificate specified with “SSLCertificateFile” directive get handed to the client?

If so, does it contain the private key as well as the public key?

share|improve this question
up vote 1 down vote accepted

Only the certificate (which contains the public key and extra information such as the identity of the machine, but not the private key) is sent to the client. If there is a chain to a CA (either via SSLCertificateChainFile or via SSLCACertificatePath or SSLCACertificateFile), the chain of certificates should be sent. You'll see the full chain with the -showcerts options with openssl s_client:

echo | openssl s_client -showcerts -connect

You may, but don't have to put the private key in the same file, it can be separated into SSLCertificateKeyFile.

share|improve this answer

Only the public key is transmitted to the client. The SSLcertificatefile specifies the public key and the directive SSLcertificateKeyFile directive is for the private key.

If you wish to see exactly what is transmited you can use openssl to connect and see the certificate. A command like this openssl s_client -connect will connect to google and you will see the public certificate and some details about the certificate.

share|improve this answer

This took me a long time to wrap my head around, but once you get it, it just clicks.

Apache won't do that. For a good reason.

You've seen those CSR's you send to get your csr, right? With the info (common name, city, state, etc.)

Well, a private key pretty much mashes that info all up, and the only way to unlock it is to use the public key. You can give that out like candy, but you don't give out the private key.

So now you send that mashed up data to some web browser when he hits your page, the browser uses your public key to decode that info. If the public key is the right one, the browser sees (common name, city, state, etc.) and knows the guy it's talking to is legit.

If the private key was some random server out there, that mashed up data would decrypt to more mashed up data. Total junk. The browser at that point knows it's talking to an imposter.

Also - the browser uses public keys from the person that signed your original key (say verisign or godaddy), cause those are well-known and trusted sources... They do that to make sure their talking to the right person too. That's why you're usually getting your certs from someone like Verisign.

Additionally - You can sign your own certs and have your users (like in an AD Domain) trust you, but you have to make sure all your users's machines trust your "signer." That's next level...

share|improve this answer

The public key gets sent to the client which encrypts the data using that public key only the private key can then decrypt the data.

The private key is never sent to the client that would defeat the whole point of encrypting the communication.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.