I understand that private key definitely does, but what about the certificate file? I also understand that the server sends (part of?) the certificate to a connecting client, but does it send the entire pem file or does it use some trick to prove to the client it's the correct server without actually divulging the entire cert?
2 Answers
https://en.wikipedia.org/wiki/Transport_Layer_Security indicates that the server's certificate is given to the client. The private key is what you want to worry about.
SSL certificate is not usable by itself without private key however without sharing it with public web clients wouldn't be able to establish secure communication.
-
3It's shared to the world when they connect to your site. It's as public as the public key.– ceejayozJun 3, 2014 at 20:18
-
correct, but as I mention at the end of the day it's unusable without private key and that's the main point.– alexusJun 4, 2014 at 14:12
-
My password might be unusable without my two-factor authentication, but that doesn't mean it's something I'd want to publicly share. SSL certificates are safe to publicly share, which is an important distinction.– ceejayozJun 4, 2014 at 14:50
-