CA is the basis of security in this scheme, so these operations are performed on the machine that is accessed only the owner of the CA.