What is a digital identity?
A digital identity is an electronic means of identifying someone. It consists of a secret you keep (your “private key”), and another part you publish freely (your “public key”). Your private key allows you to sign electronic documents whose signature everyone can verify using only your public key. Likewise, your private key can reveal (“decrypt”) secrets that were concealed (“encrypted”) by others using your public key.

What is a digital certificate?
A digital certificate is an electronic document that associates your digital identity with other information, such as your name, email address, or business. A certificate consists of the public part of your digital identity, the identity of the organization (“certificate authority” or CA) that signed your certificate, and whatever other data it chose to associate with your identity. A certificate is usually restricted for particular uses, such as digital signatures, encryption, use with web servers, etc. This is called the “key use” restriction on a certificate. Attempts to use a certificate for other purposes will fail. While it is possible to make one identity (and one certificate) with multiple uses, it is unusual  to make one for all possible uses. Making a certificate for multiple uses is also less secure. A certificate is only valid for a limited amount of time, after which it becomes invalid and must be replaced with a newer version. The certificate authority can also invalidate (“revoke”) a certificate before it expires. The validity of a certificate can be verified electronically, using the “public key infrastructure” or PKI.

How do I get a certificate?
To obtain a valid certificate, create a certificate request and send it to a certificate authority. If the authority agrees, it will make your certificate and return it to you. You can use Certificate Assistant or the web site of a commercial certificate authority to create your certificate request. You can obtain and hold many certificates signed by different CAs that are each valid separately and subject to different policies. For example, you may have one certificate that allows you to sign email, and another that allows you to identify yourself on Messages.

Where do I keep my certificates?
Digital identities, including certificates, are stored in your keychain. This makes them available for use by applications such as Mail and Safari. Certificates for others (mail correspondents, web sites, etc.) are also stored in your keychain as your computer obtains them for you. You can use Keychain Access (located in Applications > Utilities) to view and manipulate your certificates. You can freely move and copy certificates (as distinct from their associated private key) because they don’t contain personal or private information that you need to protect. It is fine to have several copies of one certificate. If you need to send a certificate to someone else, you can export it using Keychain Access and send it safely through email or by other means. Likewise, if someone sends you a certificate, you can add it to your keychain by dropping it onto Keychain Access, or using File > Import Items… menu in Keychain Access.

What is a Certificate Authority?
A certificate authority (CA) is a digital identity that signs certificates and makes them valid electronic documents. Since CAs are digital identities themselves, they can also be validated by another CA, forming what is called a “certificate chain.” For a certificate to be valid, the CA that signed it must be valid, and so on up the chain. This is automatically determined by system software when it evaluates a certificate.

Why evaluate certificates?
Use Certificate Assistant to evaluate the validity of a certificate and determine if it’s genuine. Secure software, such as Safari or Mail, evaluates certificates before using them. For example, if you use Safari to purchase something online, Safari evaluates the web site’s certificate and lets you know if it’s valid. Certificate Assistant provides more detail and offers you more control over the use of certificates.