title: X.509 Self Signed Certificates
body: <p>I'm trying to understand more about X.509 Digital Certificates.  There seems to be lots of contradiction around.  I am using <code>Bouncy Castle</code> to generate a key pair, using</p>
  
  <pre class="lang-cs prettyprint-override"><code>public static void SaveToFile(X509Certificate newCert, AsymmetricCipherKeyPair kp, string filePath, string certAlias, string password)
  {
      var newStore = new Pkcs12Store();
      var certEntry = new X509CertificateEntry(newCert);
      newStore.SetCertificateEntry(certAlias, certEntry);
      newStore.SetKeyEntry(certAlias, 
            new AsymmetricKeyEntry(kp.Private), new[] { certEntry });
  
      using (var certFile = File.Create(filePath))
          newStore.Save(certFile, password.ToCharArray(), new SecureRandom(new CryptoApiRandomGenerator()));
  }
  </code></pre>
  
  <p>This saves the generated certificate to disk. Some articles tell us there is no need to password protect the certificate as there is no <code>PRIVATE KEY</code> stored in there. Then <a href="https://stackoverflow.com/questions/5829812/x509-certificate-multi-passwords">this article</a> says the certificate does indeed contain the <code>PRIVATE KEY</code>.</p>
  
  <p>I guess I have two questions that will hopefully help me understand this:</p>
  
  <ol>
  <li>If I generate my keys in this way, should the password be the SAME as the passphrase for the <code>PRIVATE KEY</code>?</li>
  <li>Do I distribute the X.509 certificate to prove the <code>PUBLIC KEY</code> is mine (being paired to my name in the certificate) or should the certificate be kept as safe and secret as the <code>PRIVATE KEY</code> and what use is a self-signed certificate?</li>
  </ol>