A systems administrator wants to generate a self-signed certificate for an internal website. Which of the following steps should the systems administrator complete prior to installing the…

Providing the private key to a public CA exposes the server's secret key material to an external third party, which is a serious security risk and unnecessary for an internal website.

The public key alone is provided during a Certificate Signing Request (CSR) to an external CA, not an internal CA for a self-signed certificate; additionally, a self-signed certificate requires the private key for signing, not just the public key.

Providing the public key to a public CA describes the CSR process for a publicly trusted certificate, which is unnecessary and inappropriate for an internal website using a self-signed certificate.

For a self-signed or internally signed certificate, the private key is submitted to the internal CA so it can sign the certificate and bind it to the server's identity. The internal CA uses the private key to create the digital signature on the certificate, and since this is an internal site, using the organization's own CA is appropriate rather than a public CA. This keeps sensitive key material within the organization's control while establishing trust for internal users.

Providing the full key pair to the internal CA is incorrect because the private key should never leave the server or be shared with any CA; only the private key's signing capability is leveraged, not the pair transmitted together.

Providing the full key pair to a public CA is doubly incorrect because it both exposes the private key to an external party and involves a public CA unnecessarily for an internal website.