An IT administrator needs to request and implement an X.509 server certificate from a public Certificate Authority (CA) to secure a corporate web portal. Arrange the steps of the initial PKI certificate enrollment process in the correct chronological order from first to last.
- 1Generate an asymmetric public and private key pair on the local server.
- 2Create a Certificate Signing Request (CSR) containing the public key and organization identity details.
- 3Submit the CSR to the Certificate Authority for domain and identity verification.
- 4The Certificate Authority signs the identity payload with its private key and issues the X.509 certificate.
- 5Install the issued X.509 certificate and intermediate CA chain onto the web server.
Answer
The correct sequence is: 1) Generate the key pair, 2) Create the CSR, 3) Submit the CSR to the CA, 4) CA signs and issues the certificate, 5) Install the certificate on the web server.
In standard Public Key Infrastructure (PKI) workflows, certificate issuance follows a strict logical sequence. First, the requesting server generates an asymmetric key pair (private and public keys). Next, the administrator generates a Certificate Signing Request (CSR) which embeds the public key and organization identity details. The CSR is then submitted to the Certificate Authority (CA), which verifies the requester's identity. Once verified, the CA signs the certificate using its own private key and issues it. Finally, the administrator installs the signed certificate on the web server to service secure TLS connections.
Step-by-Step Solution
Key Concept
PKI Certificate Request and Enrollment Workflow