The entity in possession of an ID and secret can then enroll itself with Fabric CA. To do so, it generates a public/private key pair, creates a CSR, and sends that to Fabric CA along with the registered ID and secret in the Authorization header. Upon successful authentication, the server returns an X.509 certificate to the entity being enrolled. The entity sending the enroll request is responsible for managing the private key. These private keys should be stored in a secure fashion (such as a hardware security module).