Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Whenever I try to understand anything about SSL I always have a hard time keeping track of what "key" and "certificate" refer to. I fear many people use them incorrectly or interchangeably. Is there a standard difference between a key and a certificate?

share|improve this question
Certs used for SSL is heavily based on PKI – Zoredache Jul 15 '13 at 18:39
up vote 23 down vote accepted

A certificate contains a public key.

The certificate, in addition to the public key, contains additional information, such as issuer, what it's supposed to be used for, and any other type of metadata.

Typically a certificate is itself signed with a private key, that verifies its authenticity.

share|improve this answer
A certificate haa the public component of a key, not the entire key. – Zoredache Jul 15 '13 at 18:29
I made corrections. :) – LawrenceC Jul 15 '13 at 18:36
@Zoredache If a certificate typically only has a public key, is there a good name to call .p12 or .pfx files that contain certificates and private keys together? – drs Jul 15 '13 at 18:54
A pkcs12 is an archive format. It may contain a key, or maybe not. I usally try to always be specific when refering about what a particular file contains, or just say pkcs12 file. – Zoredache Jul 15 '13 at 19:08
Where is this additional information buried? I was looking at some certificates and it's all gibberish to me – CodyBugstein Dec 4 '15 at 3:39

An SSL certificate is obtained from a trusted Certification Authority, which vouches for secure connection of the website . SSL certificates usually contain the logo of authentication and also the public keys necessary to encrypt and decrypt data that is to be sent to the computer. SSL Keys Functions

Several SSL keys can be generated during a session. They are used to encrypt and decrypt the information being sent to and from the computer.The keys are used to verify that the information has not been modified or tampered with.

Lifecycle Difference

Certificates last longer than SSL keys. SSL certificates are obtained from Certification Authority, which can be renewed regularly by banks and businesses. SSL keys or session keys, on the other hand, are uniquely generated during the session and discarded when the session ends.

Read more here

share|improve this answer

Lets say company A has a key pair and needs to publish his public key for public usage (aka ssl on his web site).
Company A must make a certificate request (CR) to a certification authority (CA) to get a certificate for his key pair. The public key, but not the private key, of company A's key pair is included as part of the certificate request.
The CA then uses company A's identity information to determine whether the request meets the CA's criteria for issuing a certificate.
If the CA approves the request, it issues a certificate to company A. In brief CA signs company A's public key with his private key, that verifies its authenticity.

So company A's public key sigend with a valid CA's private key is called company A's certificate.

share|improve this answer
Does Company A any point associate its (Company A's) private key with its (Company A's) certificate? – Tola Odejayi Feb 11 at 21:09
No. a private key remains privet for A. – Mohsen Heydari Feb 12 at 0:25

OK, let's break this down so that non technical people can understand.

Think of it like this. A Certificate is like a safety deposit box at your bank. It contains a lot of important stuff; generally stuff that contains your identity. The certificate has a public key and needs a private key to open it.

Your safety deposit box takes two keys to open too, just like a certificate.
With a safety deposit box, the banker's key is like the public key since it stays at the bank and the public key stays with the certificate. You have the private key, which is needed to "get your certificate" and in the example of the safety deposit box, your private key is needed in addition to the public key as well.

Before you can actually open your safety deposit box, you must first verify your identity (kind of like a certificate request); once you have been identified, you use your private key along with the public key to open your safety box. This is a bit like making your certificate request, and then getting your certificate from the certification authority (as long as you can be identified (trusted) and you have the right key).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.