L03
Certificates, public/private keys and trust
Cram this first — memory hook
Public = publishable; private = protected; certificate = identity/key binding.
Exam trap
A valid certificate does not prove a website is honest. Protect the private key even when the certificate itself is public.
The slide facts
Certificates contain identifying information, a public key, expiry information and an issuer. Browser checks include trusted issuer, validity and matching name. Key management covers generation, storage, revocation and renewal.
If you have time — extra
A digital certificate connects a public key to an identity or name under an issuer's digital signature. A Certificate Authority () is a trusted issuer in a Public Key Infrastructure (). The public key is shareable; the private key must remain protected. Think of a certificate as an identity document plus a verifiable seal, not as a magic approval of every action its holder takes. The server proves control of its private key during authentication. A copied public certificate alone cannot perform that proof. Digital signing uses a private signing key and verification uses the matching public key; avoid describing all signing as encrypting with a private key. A self-signed certificate can be appropriate where trust is deliberately configured, but unfamiliar self-signing does not create public trust. Revocation addresses a certificate that should stop being trusted before its ordinary expiry.
Walkthrough
Check that the requested hostname matches the certificate, its dates are valid, its chain leads to a trusted root, and applicable revocation checks succeed. Investigate warnings rather than treating all of them as harmless.