Help Center/ Cloud Certificate Manager/ FAQs/ FAQs/ Certificate Consulting/ What Is a Public Key and a Private Key?
Updated on 2023-12-19 GMT+08:00
View PDF

What Is a Public Key and a Private Key?

A pair of public and private keys are used in the encryption method commonly known as the asymmetric encryption method. The key pair, consisting of a public key and a private key, is generated based on an algorithm. The public key is open while the private key is not. The public key is usually used to encrypt session keys, verify digital signatures, or encrypt data that can be decrypted using the corresponding private key.

The public and private key pair is unique across the whole world. If one key is used to encrypt a piece of data, the other key must be used to decrypt the data. If you use either key to encrypt a piece of data, the encrypted data can only be decrypted using the other key or the decryption fails.

Due to the privacy of a private key, you are advised to generate and keep it properly by yourself. Loss of the private key may cause website information leakage. If the private key is lost, revoke the certificate immediately and apply for a new SSL certificate for the domain name.

Working Principles of a Digital Certificate

A digital certificate uses the public key system which consists of a pair of matched keys to encrypt and decrypt data. Each user sets a specific private key that is known only to himself or herself and uses it for decryption and signature. At the same time, the user sets a public key and shares it with a group of other users for encryption and signature verification.

Because only the owner has the key, the owner can use it to generate a digital signature that no other users can generate.

A digital certificate is a file digitally signed by a CA and contains information about the owner of a public key and the public key. The simplest certificate contains a public key, name, and digital signature of the CA. Another important feature of a digital certificate is that it is valid only within a specific period of time.

Creating a Private Key

SCM has the following requirements on the encryption algorithm and length of your private key:

  • RSA
  • At least 2048 bits

    The 2048-bit SHA256 digest algorithm is recommended.

You can use either of the following methods to create your private key:

  • Using OpenSSL

    OpenSSL is a powerful and widely used security library tool. You can download the latest OpenSSL installation package from http://www.openssl.org/source/.

    The OpenSSL version must be 1.0.1g or later.

    After installing OpenSSL, run the openssl genrsa -out myprivate.pem 2048 command in the command-line interface (CLI).

    • myprivate.pem indicates your private key.
    • 2048 indicates the encryption length.
  • Using Keytool

    Keytool is a key management tool coming with JDK. You can use it to create a KEYSTORE (JKS) certificate file. Obtain Keytool by downloading a JDK package from http://www.oracle.com/technetwork/java/javase/downloads/index.html.

    By default, the public key and private key created using Keytool cannot be exported. You need to export the private key from the created KEYSTORE file.

    In the exported file, the following part is the private key:

    -----BEGIN RSA PRIVATE KEY-----
......
-----END RSA PRIVATE KEY-----

    or

    -----BEGIN PRIVATE KEY-----
......
-----END PRIVATE KEY-----

    No matter which method you use to generate a private key, you need to keep it properly because once it is lost or damaged the corresponding public key and digital certificate will be unusable.

Parent topic: Certificate Consulting