Digital certificates are electronic files that simply work like a kind of online passport.

It contains your name, a serial number, expiration dates, a copy of the certificate holder's public key (used for encrypting messages), and the digital signature of the certificate-issuing authority so that a recipient can verify that the certificate is real.

The digital certificates are used in conjunction with a public key encryption system.

An digital certificate is an electronic file which contains information that identifies you when you use our online services. Your certificate ensures the security of your online transactions because it authenticates you to our systems and allows you to digitally sign electronic documents like activity statements. Some of our online services – particularly services for business – are only accessible with a digital certificate.

To obtain Digital Certificate an organisation must apply to a Certification Authority which is responsible for validating and ensuring the authenticity of requesting organisation. The Certificate will identify the name of the organisation, a serial number, the validity date ("from / to") and the organisation's Public Key where encryption to / from that organisation is required.

In addition, the Digital Certificate will also contain the Digital Signature of the Certification Authority to allow any recipient to confirm the authenticity of the Digital Certificate.

Digital certificates can be kept in registries so that authenticating users can lookup other user’s public keys.

A global standard (X. 509 Public Key Infrastructure for the Internet) defines the requirements for Digital Certificates and the major Certificate Authorities conform to this. Such standards, and the integrity of the Certificate Authorities are vital for the establishment of 'digital trust', without which e-Commerce will never attain its potential.

In general use, a certificate is a document issued by some authority to attest to a truth or to offer certain evidence. A digital certificate is commonly used to offer evidence in electronic form about the holder of the certificate. In PKI it comes from a trusted third party, called a certification authority (CA) and it bears the digital signature of that authority.

A common use for a digital certificate is to associate or “bind” a person to a public key, which is contained in the certificate. The CA is asserting that this unique public key belongs to one individual; that individual is the person who holds the linked private key. Only the person who holds the private key can decrypt something that’s encrypted with the public key.

Digital certificates are also commonly used in electronic commerce, where the owner of a secure site will obtain a digital certificate that’s checked by a browser for a secure session. In this case, the CA is asserting that the public key belongs to the business; it’s bound to the domain. The information associated with this certificate is also used to set up an encrypted session so that others cannot see personal information like credit card numbers when they are in transit over the web.

Keys always work in pairs, one called the private key, and the other called the public key. What a public key encrypts, only the corresponding private key can decrypt, and vice versa. Public keys are distributed freely to anyone who wants to exchange secure information with you. Your private key is never copied or distributed and remains secure on your computer or server.

Digital certificates automate the process of distributing public keys and exchanging secure information. When you install a digital certificate on your computer or server, your computer or web site now has its own private key. Its matching public key is freely available as part of your digital certificate posted on your computer or web site.

When another computer wants to exchange information with your computer, it accesses your digital certificate, which contains your public key. The other computer uses your public key to validate your identity and to encrypt the information it wants to share with you using SSL (Secure Sockets Layer) technology. Only your private key can decrypt this information, so it remains secure from interception or tampering while traveling across the Internet.

For any business or website that will require such confidential information, server certificates are an important part of the website building process, one that cannot be skipped or overlooked for any reason. Having a server certificate can be to the website owners advantage because it gives the business an air of professionalism that is not often found when dealing with an e-commerce business where customers have little assurance as to the legitimacy or professionalism of the people that they are dealing with.

Personal certificates are a bit different in that they allow you to validate a website visitors identity and even restrict their access to certain portions of the website. You might want to set your website up so that web pages are only available to certain people, and personal certificates can help you do this. Personal certificates can be used for things such as sending and receiving email for private account information like forgotten passwords or username information. Personal certificates are ideal for communications such as providing partners and suppliers controlled access to websites for shipping dates, product availability, and even inventory management.

Security Standards

Most of the standard protocols being widely adopted for electronic communications rely on digital certificates:

A digital certificate contains the name of the organization or individual, the business address, digital signature public key, serial number, and expiration date. When you are online and your web browser attempts to secure a connection, the digital certificate issued for that website is checked by the web browser to be sure that all is well and that you can browse securely. The web browser basically has a built in list of all the main certification authorities and their public keys and uses that information to decrypt the digital signature. This allows the browser to quickly check for problems, abnormalities, and if everything checks out the secure connection is enabled. When the browser finds an expired certificate or mismatched information, a dialog box will pop up with an alert.

There are two main types of digital certificates that are important to building a secure website and these are server certificates and personal certificates.

A public key infrastructure consists of

1. A certificate authority (CA) that issues and verifies digital certificate. A certificate includes the public key or information about the public key.
2. A registration authority (RA) that acts as the verifier for the certificate authority before a digital certificate is issued to a requestor.
3. One or more directories where the certificates (with their public keys) are held.
4. A certificate management system.