Issuing the Certificate

Once validation succeeds, the CA constructs the to-be-signed certificate (TBSCertificate) and signs it with its issuing key.

Critical decisions:

• Validity period: shorter is safer (90 days standard now; 1 year for paid certs; 6 months trending). Long-lived certs survive private key compromises longer.
• Serial number: must be unique per issuer, ≥ 64 bits randomness (anti-collision), positive integer ≤ 20 octets.
• Extensions: include necessary KeyUsage + SAN; mark BasicConstraints critical.
• Signing algorithm: prefer ECDSA-P256 + SHA-256 or RSA-PSS-2048 + SHA-256. Avoid SHA-1, RSA-PKCS1-v1.5 for new CAs.

After signing, the cert + chain is returned to the requester.

CT (Certificate Transparency): CA also publishes the cert to one or more public CT logs. Browsers require it (since 2018 for commercial certs). Allows public auditing of issued certs — caught DigiNotar's mis-issuances.