FAQs

What is private key?

Updated on August 10, 2026

Overview

This article explains what a private key is, how it works in Public Key Infrastructure (PKI), where private keys are commonly stored, and how to protect them. Private keys are used with SSL/TLS certificates, code signing certificates, and S/MIME certificates to support secure digital communication.

How Private Keys Work

A private key is a confidential cryptographic value that is paired with a public key. Together, they form a public-private key pair. The public key can be shared, but the private key must remain secret.

Private keys support authentication, encryption, digital signing, data integrity, and non-repudiation. If data is encrypted with a public key, only the matching private key can decrypt it. This helps ensure that sensitive information can be accessed only by the intended recipient.

Private keys are created during the certificate enrollment process. The public key is included in the digital certificate, while the private key stays on the system or device that generated the Certificate Signing Request (CSR).

PKI Components Related to Private Keys

Coponent	Purpose
PKI	PKI uses technical mechanisms and policies to secure communications through public and private key pairs.
Digital certificates	Digital certificates validate identities online and support authentication, confidentiality, integrity, non-repudiation, and access control.
Public and private key pair	The public key and private key are cryptographically linked. The public key can encrypt data, and the matching private key can decrypt it.
Private key storage	Private keys are typically stored in encrypted form on a computer hard drive, smart card, hardware security module, or USB token.
Security controls	Private keys should be protected with strong passwords, access controls, and physical security for the device that stores the key.

Common Use Cases

Securing web traffic with HTTPS: Private keys support SSL/TLS certificates, enabling encrypted and authenticated communication between browsers and websites.
Authenticating users or devices: Private keys help validate a user or device identity for VPN access, enterprise networks, or privileged systems.

Digitally signing documents, email, and software: Private keys create digital signatures used in code signing, S/MIME email signing, and document validation.

Protecting a Private Key

To maintain security, protect the private key at all times.

Do not share your private key with anyone.

Use strong, unique passwords during key generation and storage.

Physically secure computers, smart cards, USB tokens, or other devices that store the private key.

Do not leave devices that store private keys unlocked or unattended.

Avoid entering or uploading private keys into public tools, public CSR decoders, shared folders, or unsecured systems.

If a Private Key Is Compromised

If you suspect that a private key has been exposed, copied, shared, or misused, take immediate action.

Notify your Certificate Authority (CA) immediately.

Revoke all certificates associated with the compromised private key.

Generate a new public-private key pair.

Issue new certificates using the newly generated key pair.

Prompt revocation helps prevent attackers from impersonating the certificate holder, forging signatures, or accessing sensitive systems.

Consequences of Sharing or Exposing a Private Key

The affected certificate must be revoked or reissued immediately.

If Sectigo determines that a private key was shared, compromised, or generated insecurely, all affected certificates will be revoked within 24 hours.

Revocation may occur if the private key is found in insecure locations, such as public CSR decoders, or if it was created using vulnerable software.

Frequently Asked Questions

Can I share my private key?

No. A private key must remain confidential. Sharing it can allow unauthorized users to impersonate the certificate holder or decrypt protected data.

Where is my private key stored?

The private key remains on the system or device that generated the CSR. It may be stored on a computer, smart card, hardware security module, or USB token, depending on how the certificate request was created.

What should I do if I accidentally exposed my private key?

Contact your CA immediately, revoke any certificates associated with the exposed key, generate a new key pair, and request replacement certificates.

Does Sectigo receive or store my private key?

No. During certificate enrollment, the public key is included in the digital certificate. The private key remains with the requester and must be protected by the requester.