The certification authority then notifies the subscriber that the certificate has been issued so as to give the subscriber an opportunity to review the contents of the certificate before it is made public. It is important that the subscriber be given an opportunity to double-check the accuracy of the contents of the certificate because the subscriber may be bound by any communication digitally signed with the private key that corresponds to the public key contained in the certificate or held liable for misrepresentations to the certification authority. If the subscriber finds that the certificate is accurate, the subscriber may publish the certificate, or direct the CA to do so, making it available to third parties who may wish to communicate with the subscriber. A certificate is published by being recorded in one or more repositories or circulated by any other means so as to make it accessible to all intended correspondents. A repository is generally available online and may be maintained by the certification authority or by anyone providing repository services.
Repositories are generally accessible to anyone.
Repositories contain other important information as well as certificates. If a private key is compromised or lost, such as through loss of the medium on which it is stored or accidental deletion, it is generally necessary to suspend or revoke the corresponding certificate so that others will know not to rely on communications digitally signed with that key. This information is also posted in the repository. Once a certificate has been published, the subscriber may then append the certificate to any electronic communication. If the recipient wants to verify the connection between the sender and his public key, the recipient can look to the attached certificate for some assurance.