royal wrote: Signing = You use your private key to sign the data, and then you send your public key to the receiving party so they can use your public key for verification. Encryption = You use the receiving parties public key so they can decrypt it with their private key. For issuing, when you generate a request, you create a private key and a CSR. When a CA manually approves, it generates some information you put into a .CER in which you fullfill your certificate request. The .CER basically contains your public key information that you import and bind to your private key when you created your initial request. Does this help?