Front cover - IBM Redbooks

Figure 6-17 PKI Components
234 Lotus Security Handbook
As an alternative, a CA can generate a client’s key pair and, subsequently, the
signed certificate for that client. This process, however, is seldom implemented
because the private key needs to be forwarded from the CA to the client, which
can be a weak link. It is generally considered more secure when the clients
generate their own key pairs, in which case the private keys never leave their
area of authority.
In order for a public key infrastructure to work completely, the basic assumption
is that any party who wishes to verify a certificate must trust its digital signer CA.
In the PKI, “A trusts B” means that “A trusts the CA that signed B’s certificate.”
Thus, in general terms, “A trusts CA” means that “A” holds a copy of the CA’s
certificate locally.