Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've created an RSA key. Created a CSR. Got it signed and now I have my certificate. It's for a webserver running https.

The public key can be generated from the private key, so I guess I don't need to keep a separate file with the public key in unless my application needs it (it doesn't).

But can I just delete the CSR now or does it contain anything I might later need?

share|improve this question
Do you mean "public key can be generated from the certificate?" I don't believe you can re-create the pubkey given the privkey; if that was possible the reverse would also be true with catastrophic effects. – gowenfawr Jun 24 '13 at 14:22
@gowenfawr what? That's the point of a pubkey, it's generated from the privkey. The reverse is not possible. – Manishearth Jun 24 '13 at 14:40
@gowenfawr can the pubkey come from the certificate? This answer explains what I meant. But anyway, the question remaining is: do I need the CSR? – artfulrobot Jun 24 '13 at 14:47
I stand corrected (which for me, with math, ain't hard)! Fascinating. And, @artfulrobot, no - you don't need the CSR for anything and can safely delete it. – gowenfawr Jun 24 '13 at 14:50
@Gowenfawr - it's worth noting that the private key can only be used to get the public key because the private key stores information that is not strictly speaking part of the private key. The extra data is kept due to performance increases though. – AJ Henderson Jun 24 '13 at 15:41
up vote 6 down vote accepted

There's no need to keep either. Of course, you may want to store your public key for convenience (should you ever need to use it directly). For example, I keep my SSH public keys even though I can regenerate them whenever I want -- If I need to copy a specific key to a server, it's more convenient to not have to generate it.

The CSR is also something you can regenerate given the private key. The CSR itself has no power after the certificate is signed. It's OK to release it publicly or to delete it.

share|improve this answer
what about all the details I put in to generate the CSR? common name etc. Can these details be retrieved from the certificate? – artfulrobot Jun 24 '13 at 17:50
@artfulrobot only partially. I was assuming that these would be remembered by you. Either way, a CSR is useless once you have the cert. – Manishearth Jun 24 '13 at 17:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.