3

I have a small PKI for our web server that will require client certificates.

When generating the private key for CSR (edit: CSR for a client certificate ), I can do it with or without a pass phrase.

What is the importance of using a pass phrase (or not)?.

EDIT 2: For my setup, I will be giving users a PFX/P12 file, which will have an export/import passphrase, since the only passphrase I used when importing a client certificate was the "export" passphrase, I guess the private key is included in the PFX/P12?

if so, there's not much difference for me to whether I use a passphrase for the key or not, right?

So if all above is right, , why would I want to protect the private key?

Improve this question

1 Answer 1

Reset to default
2

The passphrase is used to protect and encrypt the private key. You will create the private key either encrypted or not. If you encrypt the private key, it must be decrypted before use in any transaction with that passphrase. Doing this provides an additional layer of protection over that key.

A quick read of this document will be helpful: OpenSSL Essentials

Improve this answer
3
  • I failed to mention that the CSR I'm talking about is for generating the client certificate. The question is what is the point on securing they private key? I tried creating a certificate and export it as PFX/P12 file and then importing it as user, the only passphrase I was required was the one I set for the export, but NOT for the private key itself.
    – joovunir
    Commented Feb 13, 2018 at 7:57
  • The password you set at export was for the PFX file and it does contain the private key if you elected to export with that option.
    – Tara Hodges
    Commented Feb 14, 2018 at 0:57
  • So the question still remains: why would I want to protect the private key of a client certificate?
    – joovunir
    Commented Feb 14, 2018 at 10:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .