What Is a Public Key and a Private Key?

Working Principles of a Digital Certificate

A digital certificate uses the public key system which consists of a pair of matched keys to encrypt and decrypt data. Each user sets a specific private key that is known only to himself or herself and uses it for decryption and signature. At the same time, the user sets a public key and shares it with a group of other users for encryption and signature verification.

Because only the owner has the key, the owner can use it to generate a digital signature that no other users can generate.

A digital certificate is a file digitally signed by a CA and contains information about the owner of a public key and the public key. The simplest certificate contains a public key, name, and digital signature of the CA. Another important feature of a digital certificate is that it is valid only within a specific period of time.

Creating a Private Key

HUAWEI CLOUD SCM has the following requirements on the encryption algorithm and length of your private key:

• RSA
• At least 2048 bits
  

  The 2048-bit SHA256 digest algorithm is recommended.

You can use either of the following methods to create your private key:

• Using OpenSSL

  OpenSSL is a powerful and widely used security library tool. You can download the latest OpenSSL installation package from http://www.openssl.org/source/.

  

  The OpenSSL version must be 1.0.1g or later.

  After installing OpenSSL, run the openssl genrsa -out myprivate.pem 2048 command in the command-line interface (CLI).

  • myprivate.pem indicates your private key.
  • 2048 indicates the encryption length.
• Using Keytool

  Keytool is a key management tool coming with JDK. You can use it to create a KEYSTORE (JKS) certificate file. Obtain Keytool by downloading a JDK package from http://www.oracle.com/technetwork/java/javase/downloads/index.html.

  By default, the public key and private key created using Keytool cannot be exported. You need to export the private key from the created KEYSTORE file.

  In the exported file, the following part is the private key:

  -----BEGIN RSA PRIVATE KEY-----
  ......
  -----END RSA PRIVATE KEY-----

  or

  -----BEGIN PRIVATE KEY-----
  ......
  -----END PRIVATE KEY-----

  

  No matter which method you use to generate a private key, you need to keep it properly because once it is lost or damaged the corresponding public key and digital certificate will be unusable.