0

This is a follow up question , after getting a signed certificate from one CA.

researched a lot , but no luck. After getting the CA reply, While downloading the certificate, it popped up saying "creating a private key” with passphrase.

  1. Why it’s asking to create a private key? What is its use? (say PK1)
  2. While creating the CSR, i already had the private key (SAY PK2). Are PK1 and PK2 same?
  3. Someone from CA can also get it, like i did, so how it’s not vulnerable to attack?

I completed the wizard, and downloaded the certificate with PK1.

I referred all the possible below links but not getting above answers

Previous question link - previous post

UPDATE 1

UPDATE 1

researched a lot, to find the answers of question posted but no luck. I am getting stuck at this point, is the signed certificate from CA also has a private key or its only a public key ? As far as i got "A P7B/pkcs7 file only contains certificates and chain certificates" which we need to import as "CA reply" in out keystore.

Improve this question
1
  • I tried with one tool called XCA,though its a local CA it didn't ask for pass phrase while signing, which i expected, but still curious why it asked for password as per above question.
    – Pallab
    Commented Mar 7, 2015 at 18:25

1 Answer 1

Reset to default
0

The basic protocol for getting a singed certificate from a CA is the following:

  • Requester generates a key pair (a private key and a public key)
  • The private key is put aside and should never leave the computer
  • Requester generates a Certificate Signing Request (CSR) which contains basic information that will go into the final certificate (Distinguished Name, Country, ...)
  • Requester submits the CSR to the CA which will verify it (eventually contact the requester to establish it's identity)
  • When the CA trusts the CSR belongs to the identified person, the CA will issue a certificate which is basically the CSR signed by the CA's private key (plus some information to track the signature back to the CA)
  • The requester can now use the certificate which embeds it's public key signed by the CA to establish communication with clients.

So when importing the signed certificate, you should not have to create any private key (you should already have it). It is also good to know that many program managing key generation will also propose to put the private key into a secured file. This file will be encrypted (AES probably) with a passphrase you should supply.

Improve this answer
4
  • CSR is signed by the CA's public key or its private key? as generally we sign using the private key and encrypt using (partners public key). Also 2nd question is isn't is necessary to add the CA certified certificate to the key store also using the "import CA reply" or its not mandatory?
    – Pallab
    Commented Mar 9, 2015 at 14:40
  • Signatures are performed with private key and checked using public key. Encryption is done with public key and decrypted by private key. So your CSR (which embeds your public key) is signed by the the CA private key. You can verify this signature by getting the CA root certificate (which holds the CA public key). This root certificate can be added to the list of the trusted root certificate for automatic checking of signature by most PKI software.
    – M'vy
    Commented Mar 9, 2015 at 14:44
  • great, in your earlier comment it is "CSR signed by the CA's public key" so got confused, thanks for help. Also edit it for future reference
    – Pallab
    Commented Mar 9, 2015 at 14:47
  • Good catch. I'll edit that :)
    – M'vy
    Commented Mar 9, 2015 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .