How do digital certificates work

First, the sender hashes the data package using a hashing algorithm. Hashing is a one-way math function that generates a unique text string based on the input. After hashing comes encryption or, more specifically, asymmetric encryption. Asymmetric means that the sender and receiver hold different parts of the key. As its name implies, asymmetrical encryption needs two keys: a public key that can be shared, and a private key exclusive to the sender.

The sender generates the keys upon initial transmission. Before transferring data, the sender encrypts the hashed data also known as a data-digest using the private key. The resulting output is the digital signature. The digital signature, along with the public key, is then appended to the original, unmodified data and sent to the recipient. The receiver, upon receiving the data pack, decrypts the signature using the attached public key to reveal the message digest. If the signature can be decrypted using the public key, then the recipient can be sure that the data came from the expected sender.

The receiver then performs the same hashing function on the unmodified data to generate their own data-digest.

Note that digital signatures do not verify the identity of the sender; all it guarantees is that the data originated from a single source, hence its name. Remember, digital signatures only verify that data came from one source.

Theoretically, any malicious actor can generate a key pretending to be the original sender and hijack a conversation. To thwart these attempts, organizations can apply for a digital certificate that helps to prove their identity. These digital certificates can be obtained, at a cost, from certification authorities CA. During the application process, the applicant would generate a private-public key pair and send the public key to the CA, along with identification documents. Upon receiving the certificate, the client first checks which CA signed the document and its signature.

As a side note, some CAs need to be vetted by CAs of a higher authority. Companies go out of business all the time, and people change roles just as frequently. Because digital certificate verifies the identity of a person or organization, they need to be renewed often to ensure that the entity holding the certificate is still who they say they are.

Keeping track of when certificates expire can be a hassle. Some web browsers today, including the Apple Safari and Google Chrome, now only accept certificates that are up to days old, which is almost half the previous renewal time. This could cause even more management headaches. Moreover, when a company is holding thousands of certificates for different functions, renewing them can accumulate significant costs. CAs can also go defunct or be delisted as untrusted sources.

In our previous post, we discussed what a digital certificate is. But how do digital certificates work? Today, we're going to give you an overview of the basic process involving the creation, signing, deployment, and use of digital certificates. There are different types of digital certificates but we'll be focusing on the server certificates used in secure web servers since they're the most common. You come across these kinds of certificates on the Web everyday, particularly when you connect to sites that support HTTPS.

A CA-signed server certificate is the kind of certificate you would need to deploy if you don't want Web browsers to display a warning when users attempt to connect to your secure file transfer server. Before any major Web browser like Chrome, Firefox, Safari or Internet Explorer connects to your server via HTTPS, it already has in its possession a set of certificates that can be used to verify the digital signature that will be found on your server certificate.

These web browser digital certificates are called CA Certificate Authority certificates. On these certificates is a copy of the public key of the CA who might issue sign your server certificate. CA certificates of widely accepted certificate authorities are already pre-installed on popular Web browsers, so we don't worry about installing them anymore. This explains how CA certificates can verify the digital signature on server certificates more about this process later.

The private keys that are used for signing the server certificates already have their corresponding public key pairs on our users' Web browsers. Depending upon the Certificate Authority you are using, you may be required to supply specific information. There also may be restrictions and limitations on whom you send documents to for signing and the order in which you send them.

Public Key Infrastructure PKI is a set of requirements that allow among other things the creation of digital signatures. Through PKI, each digital signature transaction includes a pair of keys: a private key and a public key.

The private key, as the name implies, is not shared and is used only by the signer to electronically sign documents. PKI enforces additional requirements, such as the Certificate Authority CA , a digital certificate, end-user enrollment software, and tools for managing, renewing, and revoking keys and certificates. Digital signatures rely on public and private keys. Those keys have to be protected in order to ensure safety and to avoid forgery or malicious use. When you send or sign a document, you need assurance that the documents and the keys are created securely and that they are using valid keys.

CAs, a type of Trust Service Provider, are third-party organizations that have been widely accepted as reliable for ensuring key security and that can provide the necessary digital certificates. Both the entity sending the document and the recipient signing it must agree to use a given CA. That means you can always send a document with a digital signature by using DocuSign as the Certificate Authority.

Alternatively, you can securely establish your own CA using the DocuSign Signature Appliance and still access the rich features of DocuSign cloud services for transaction management. Some organizations or regions rely on other prominent CAs, and the DocuSign platform supports them, as well. See the full list of Certificate Authorities we support. Many industries and geographical regions have established eSignature standards that are based on digital signature technology, as well as specific certified CAs, for business documents.

Following these local standards based on PKI technology and working with a trusted certificate authority can ensure the enforceability and acceptance of an e-signature solution in each local market. By using the PKI methodology, digital signatures utilize an international, well-understood, standards-based technology that also helps to prevent forgery or changes to the document after signing.

Both acts made electronically signed contracts and documents legally binding, like paper-based contracts. Since then, the legality of electronic signatures has been upheld many times. By now, most countries have adopted legislation and regulations modeled after the United States or the European Union, with a preference in many regions for the E. In addition, many companies have improved compliance with the regulations established by their industries e.

These country- and industry-specific regulations are continuously evolving, a key example being the Electronic identification and trust services eIDAS regulation that was recently adopted in the European Union. A digital certificate is an electronic document issued by a Certificate Authority CA. It contains the public key for a digital signature and specifies the identity associated with the key, such as the name of an organization.