private key - X.509 Self Signed Certificates -

i'm trying understand more x.509 digital certificates. there seems lots of contradiction around. using bouncy castle generate key pair, using

public static void savetofile(x509certificate newcert, asymmetriccipherkeypair kp, string filepath, string certalias, string password) {     var newstore = new pkcs12store();     var certentry = new x509certificateentry(newcert);     newstore.setcertificateentry(certalias, certentry);     newstore.setkeyentry(certalias,            new asymmetrickeyentry(kp.private), new[] { certentry });      using (var certfile = file.create(filepath))         newstore.save(certfile, password.tochararray(), new securerandom(new cryptoapirandomgenerator())); } 

this saves generated certificate disk. articles tell there no need password protect certificate there no private key stored in there. this article says certificate indeed contain private key.

i guess have 2 questions me understand this:

1. if generate keys in way, should password same passphrase private key?
2. do distribute x.509 certificate prove public key mine (being paired name in certificate) or should certificate kept safe , secret private key , use self-signed certificate?

a pkcs#12 file can contain both certificate , private key. are, however, stored separate, distinct objects. certificate has public key embedded within it. since certificate contains public key, considered "public" well. can feel free distribute certificate, not contain private key, should kept confidential. basis of security in asymmetric cryptography.

because pkcs#12 file contains both items, encrypted password protect private key within it. said, use private key prove certificate distribute belongs you. example, through use of digital signature on document.

hope helps!