I'm trying to set up OpenVPN and I'm a bit confused about the terms.
From what I've read, a PKI consists of:
- A separate certificate (also known as a public key)
- A private key for the server and each client.
That part I'm fine with and I understand.
The second part of a PKI, and the part I'm having a bit of trouble understanding due to all the different terms is about the Certificate Authority (CA).
The documentation says
Generate the master Certificate Authority (CA) certificate & key
In this section we will generate a master CA certificate/key, a server certificate/key certificate and key which is used to sign each of the server and client certificates.
The terms I have heard thrown around and part of what confused me is people referring to
- Master keys
- Root Certificates
- Certificate Authority private keys
- Certificate Authority keys
- Certificate Authority certificates
I'm not sure if several of these are all referring to the same thing but the Certificate Authority has me very confused.
Why does the certificate Authority have keys in the first place? I thought the job of the Certificate Authority was to sign keys on servers and clients. Does the CA also need a private key in this process? Is this private key with people referring to when they talk about master keys or root certificates. And are these root certificates the same thing as private keys?
I've been through several web pages and I'm still having trouble understanding the CA.