59

Can we generate the CSR (certificate signing request) used for certificate signing from the signed certificate? It should work with the original private key when signed again with different authority.

Improve this question
1
  • 2
    Original requirement is to generate the CSR without private key.
    – NPC
    Commented Jun 9, 2016 at 14:20

3 Answers 3

Reset to default
39

What the user literally asked and actually wanted are slightly different things. Here is how to get what the user asked for. Hat tip

openssl x509 -x509toreq -in $SITENAME.crt -signkey $SITENAME.key -out $SITENAME-new.csr

This uses the all the certificate meta-information and the existing key from the existing certificate to create a new CSR. The new CSR must be sent to the new provider.

Note: it is seen as somewhat of a risk to re-use the same key over very long periods of time. However, given that certificates must be renewed every year or two years, while a 2048-bit key should be secure through 2030. This assumes your site has not been compromised in anyway and that the key was not leaked due to the various vulnerabilities found in SSL in the last ten years.

For SNI: With hat-tip to "shams.haq" (unverified), with openSSL 3+:

openssl x509 -x509toreq  -copy_extensions copyall -in $SITENAME.crt -signkey $SITENAME.key -out $SITENAME-new.csr
Improve this answer
6
  • 1
    It would appear this method does not carry along the alternative names.
    – DustWolf
    Commented Jul 9, 2021 at 14:18
  • @DustWolf True true. I worked up a script to this, but lost it -- it's a bit complicated. It can still be done in one line.
    – Otheus
    Commented Jul 26, 2021 at 17:14
  • 4
    With openssl 3.0.0 you can use 'copy_extensions' option to get the alternative names carried over. [openssl.org/docs/manmaster/man1/… ] Example : openssl x509 -x509toreq -copy_extensions copyall -inform DER -in myapp_cert.cer -signkey my_private.key -out myapp-new.csr
    – shams.haq
    Commented Oct 20, 2021 at 1:01
  • 1
    Great tip @shams.haq ... very useful for renewals ;) ... for newer MacOS versions that ship LibreSSL instead of the actual OpenSSL you can install with homebrew brew install openssl@3 and then force link it via brew link --force openssl and in a new terminal session or if you source your profile it should work...if it doesn't you can link it directly via PATH like export PATH="/usr/local/opt/openssl@3/bin:$PATH" and then the very useful openssl x509 -x509toreq -copy_extensions copyall -in $SITENAME.crt -signkey $SITENAME.key -out $SITENAME-new.csr functions as expected.
    – TryTryAgain
    Commented Jun 16, 2022 at 19:22
  • -ext subjectAltNames may be added to copy just the alternative names.
    – wrwrwr
    Commented Oct 18, 2022 at 12:46
20

Using OpenSSL, this is what you would do:

$ openssl req -out codesigning.csr -key private.key -new

Where private.key is the existing private key.

As you can see you do not generate this CSR from your certificate (public key). Also you do not generate the "same" CSR, just a new one to request a new certificate.

As per your comment, if you do not have access to the existing private key then you can create a new private key and CSR:

$ openssl req -out codesigning.csr -new -newkey rsa:2048 -nodes -keyout private.key

The end results remain the same, you get a CSR and issue a new certificate.

Improve this answer
5
  • As mentioned in the question, i do not have access to private key, but i want newly generated certificate to work with existing private key.
    – NPC
    Commented Jan 28, 2016 at 21:42
  • All right, then your last chance is to find the CSR that was generated with this Private key. If you have lost our don't have access to this CSR, you are in a dead end.
    – Florian Bidabé
    Commented Jan 28, 2016 at 21:45
  • Also, as the owner of the remote device, you can either download a new CSR that the device generated for you, or regenerate a private key and CSR. If you cannot connect to this device and do not have access to the existing private key, then you cannot generate a new CSR, therefore you cannot re-issue a new certificate. The only issue that remains here is that you are either locked out of your own device or do not own this device.
    – Florian Bidabé
    Commented Jan 28, 2016 at 23:17
  • how to keep the same public key for the new csr ? do we need to use same private key for generation, or need anything other than this? please help
    – ɹɐqʞɐ zoɹǝɟ
    Commented Jun 8, 2017 at 11:54
  • 1
    (4 year later) @ɹɐqʞɐzoɹǝɟ The private key can be anything (same one or new). The issuer does not know about it and does not care. It is however good idea and opportunity to use a new key, just in case old one could have been compromised.
    – FractalSpace
    Commented Apr 15, 2021 at 17:51
8

Yes, as long as you have the private key, you can re-issue a new CSR by copying the fields (Country Name, State or Province Name, Locality Name, Organization Name, Organizational Unit Name, Common Name, Email Address) from the existing certificate to the CSR.

Edited from my comment: If you don't own the private key anymore you cannot generate a CSR. The private key is required in order to verify the identity of the requester (you) via digital signature; otherwise it would be trivial to generate CSRs - and then certificates - with fake credentials, and spoof any existing entity.

Improve this answer
7
  • 1
    I do not have access to the private key to generate the CSR, as it is in the remote device and I can only apply new certificate. Currently I have is only existing certificate.
    – NPC
    Commented Oct 30, 2015 at 12:48
  • 1
    You need to copy Subject DN (which can be a subset of the fields you listed) AND PUBLIC KEY, and sign the result. Note you don't need to write any code with (tagged) openssl since openssl x509 -x509toreq already does this. But as you say it needs privatekey to sign.
    – dave_thompson_085
    Commented Oct 30, 2015 at 20:29
  • 1
    Hi Vaibhav, what sort of "remote device" is that ? Some appliance generate a private key and CSR then offer you to download the CSR. (they keep their private key secure but not providing access to it)
    – Florian Bidabé
    Commented Jan 27, 2016 at 21:41
  • 7
    +1 I agree that you need to prove possession of the private key in a csr, but I don't agree with your reason why: "otherwise it would be trivial to generate CSRs ... spoof any existing entity." - So I manage to get a cert that I don't have the private key for...how is that any different from grabbing the cert for google.com from my browser? It's fine that I have it because won't be able to actually use the cert for anything.
    – Mike Ounsworth
    Commented Jan 27, 2016 at 22:27
  • 4
    " as long as you have the private key, you can re-issue a new CSR by copying the fields ... from the existing certificate to the CSR." Yes, how do you do that, from the command line?
    – Otheus
    Commented Apr 20, 2016 at 13:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .