0

I understand that private key definitely does, but what about the certificate file? I also understand that the server sends (part of?) the certificate to a connecting client, but does it send the entire pem file or does it use some trick to prove to the client it's the correct server without actually divulging the entire cert?

2 Answers 2

7

https://en.wikipedia.org/wiki/Transport_Layer_Security indicates that the server's certificate is given to the client. The private key is what you want to worry about.

0

SSL certificate is not usable by itself without private key however without sharing it with public web clients wouldn't be able to establish secure communication.

4
  • 3
    It's shared to the world when they connect to your site. It's as public as the public key.
    – ceejayoz
    Jun 3, 2014 at 20:18
  • correct, but as I mention at the end of the day it's unusable without private key and that's the main point.
    – alexus
    Jun 4, 2014 at 14:12
  • My password might be unusable without my two-factor authentication, but that doesn't mean it's something I'd want to publicly share. SSL certificates are safe to publicly share, which is an important distinction.
    – ceejayoz
    Jun 4, 2014 at 14:50
  • once again, you're absolutely correct.
    – alexus
    Jun 4, 2014 at 15:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .