5

I have noticed that a number of different web and mail server software allow or require you to provide the TLS certificate (including server certificate, CA intermediate certificate, and CA root certificate) and private key in a single .pem file.

So, the server sends the certificate(s) to every client attempting to connect, but, of course, you want to keep your private key secure and secret. So, how does this work when they are all in the same file? Does the software know to only send the certificate parts and never send the private key, even though they are in the same file?

Thank you.

4

Does the software know to only send the certificate parts and never send the private key, even though they are in the same file?

Yes.

  • Thanks. Is there a simple way for you to elaborate on how this works? – user981178 Oct 2 '13 at 19:29
  • 1
    In the same way you put several things into one file, the server can open the file and take the things out separately. A PEM file is one way of many to give information to the server (see serverfault.com/a/9717/57144 ). When you make an SSL connection, you are not transferring 'files' from web server to browser, but SSL connection data. Files only exist on filesystems and file sharing connections like NFS. When a file is opened, the content can be used and split and processed any way the software wants, it doesn't all have to stay together in one lump. – TessellatingHeckler Oct 2 '13 at 19:38
  • Thanks again. Maybe it uses the -----Begin ...----- and -----End ...----- declarations to help it determine what parts to send what parts not to send? – user981178 Oct 2 '13 at 19:42
  • 1
    Almost certainly yes. stackoverflow.com/a/7539644 – TessellatingHeckler Oct 2 '13 at 19:55

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.