The mechanism underneath certificates.
THE PAIR
A certificate involves two related keys. The public key is in the certificate and anyone can have it. The private key stays on your server and must never be shared.
Data encrypted with one can only be decrypted with the other, which is what makes the arrangement work.
WHY THE PRIVATE KEY MATTERS
Anyone holding your private key can impersonate your site. It is the single most sensitive file involved.
WHERE IT LIVES
cPanel stores it for you. With AutoSSL you never handle it directly.
If you generate a certificate manually, the private key is created alongside the signing request and must be kept.
PRACTICAL RULES
Never email a private key Never store one in a publicly reachable folder Never reuse the same key across unrelated services If a private key is exposed, the certificate must be revoked and reissued
WHAT A CSR IS
A certificate signing request contains your public key and the details to be certified. You send it to the authority; the private key never leaves your server.
