ITPEC FE Morning October 2023 Question 44

The unencrypted public key of the website — a certificate exists to publish that key, bound to the site's identity by the CA's signature.

An SSL/TLS (X.509) certificate holds the subject (the site's domain name), the issuer, the validity period, the site's public key and the certificate authority's digital signature over all of it. The server sends the certificate to every client in the TLS handshake, so the public key must be readable by anyone. Its integrity is protected by the CA signature, not by encryption. The private key stays on the server and never appears in the certificate.

Answer (d)

Why not others:

• •(a) and (c) — a private key is never put in a certificate, encrypted or not; the certificate is public, and exposing the private key would let anyone impersonate the site
• •(b) — the public key is not encrypted; clients must read it directly to verify signatures and set up the session

Key rule: A certificate is a public document: it carries the plaintext public key plus the CA's signature that vouches for whose key it is.

Security · AI-written, may contain errors