Naja rein theoretisch könnte jeder ein Zertifikat erstellen, und die CA bestätigt das dieses Zertifikat zum jeweiligen Benutzer gehört.
Hier ganz unten (unter der Tabelle) steht folgendes:
Zitat:
Now wait, you may say. Shouldn't it be possible to set up the PKI without a pre-existing secure channel?
The answer is ostensibly yes. In the example above, for the sake of brevity, we generated all private keys in the same place. With a bit more effort, we could have done this differently. For example, instead of generating the client certificate and keys on the server, we could have had the client generate its own private key locally, and then submit a Certificate Signing Request (CSR) to the key-signing machine. In turn, the key-signing machine could have processed the CSR and returned a signed certificate to the client. This could have been done without ever requiring that a secret .key file leave the hard drive of the machine on which it was generated.
Nur wie das ganze genau funktioniert weiß ich nicht.
MfG
Fabian