Principle of a public key infrastructure.
CA: certification authority, RA: registration authority, VA: validation authority
Rough outline: A user applies for a certificate with his public key at a registration authority (RA). The latter confirms the user's identity to the certification authority (CA) which in turn issues the certificate. The user can then digitally sign a contract using his new certificate. His identity is then checked by the contracting party with a validation authority (VA) which again receives information about issued certificates by the certification authority.
Own work using: [1] and OpenCliparts.org
Chris 論