What Are the Differences Between CA, Local, and Self-Signed Certificates?

Self-signed certificate

A self-signed certificate, which is also called root certificate, is issued by an entity to itself. In this certificate, the issuer name and subject name are the same.

If an applicant fails to apply for a local certificate from the CA, it can generate a self-signed certificate. The self-signed certificate issuing process is simple.

Huawei devices do not support lifecycle management (such as certificate renewal and revocation) for self-signed certificates.

CA certificate

CA's own certificate. If a PKI system does not have a hierarchical CA structure, the CA certificate is the self-signed certificate. If a PKI system has a hierarchical CA structure, the top CA is the root CA, which owns a self-signed certificate.

An applicant trusts a CA by verifying its digital signature. Any applicant can obtain the CA's certificate (including the public key) to verify the local certificate issued by the CA.

Local certificate

A certificate issued by a CA to the applicant.

Local device certificate

A certificate issued by a device to itself according to the certificate issued by the CA. The issuer name in the certificate is the CA server's name.

If an applicant fails to apply for a local certificate from the CA, it can generate a local device certificate. The local device certificate issuing process is simple.