Certificate issuance creates an X.509 certificate after a certificate authority validates a certificate signing request (CSR) and the applicant’s control of the requested domain. The CA signs the certificate with its private key, allowing clients to verify its authenticity through a trusted chain. section 9.1.4 section 9.4
Figure 9.1 The certificate life cycle. This figure walks you through the four main steps of getting a valid digital certificate: generating a key pair, creating a CSR, having it validated by a CA, and receiving the issued certificate.
Follow the lifecycle from generating a key pair and creating a CSR through validation and receiving the issued certificate. section 9.1
A typical issuance flow includes:
- Generate a private key and corresponding public key. section 9.4
- Create a CSR containing the public key and certificate metadata. section 9.4
- Validate domain control through email, HTTP-01, or DNS-01 verification. section 9.4
- Issue and sign the certificate when validation succeeds. section 9.1.4
Internal services
A checkout service calling an inventory service may use a private CA for internal HTTPS. A self-signed certificate is easy to create, but browsers and systems do not trust it without extra configuration; disabling validation defeats the security benefit. section 9.1.4 section 9.4
