21

Can we generate the CSR (certificate signing request) used for certificate signing from the signed certificate? It should work with the original private key when signed again with different authority.

  • 1
    Original requirement is to generate the CSR without private key. – vaibhav magar Jun 9 '16 at 14:20
15

Using OpenSSL, this is what you would do:

$ openssl req -out codesigning.csr -key private.key -new

Where private.key is the existing private key.

As you can see you do not generate this CSR from your certificate (public key). Also you do not generate the "same" CSR, just a new one to request a new certificate.

As per your comment, if you do not have access to the existing private key then you can create a new private key and CSR:

$ openssl req -out codesigning.csr -new -newkey rsa:2048 -nodes -keyout private.key

The end results remain the same, you get a CSR and issue a new certificate.

  • As mentioned in the question, i do not have access to private key, but i want newly generated certificate to work with existing private key. – vaibhav magar Jan 28 '16 at 21:42
  • All right, then your last chance is to find the CSR that was generated with this Private key. If you have lost our don't have access to this CSR, you are in a dead end. – Florian Bidabe Jan 28 '16 at 21:45
  • Also, as the owner of the remote device, you can either download a new CSR that the device generated for you, or regenerate a private key and CSR. If you cannot connect to this device and do not have access to the existing private key, then you cannot generate a new CSR, therefore you cannot re-issue a new certificate. The only issue that remains here is that you are either locked out of your own device or do not own this device. – Florian Bidabe Jan 28 '16 at 23:17
  • how to keep the same public key for the new csr ? do we need to use same private key for generation, or need anything other than this? please help – ɹɐqʞɐ zoɹǝɟ Jun 8 '17 at 11:54
  • You use a CSR to request a new public cert, so I'm not sure your question is making sense. What are you trying to do ? – Florian Bidabe Jun 9 '17 at 0:51
5

Yes, as long as you have the private key, you can re-issue a new CSR by copying the fields (Country Name, State or Province Name, Locality Name, Organization Name, Organizational Unit Name, Common Name, Email Address) from the existing certificate to the CSR.

Edited from my comment: If you don't own the private key anymore you cannot generate a CSR. The private key is required in order to verify the identity of the requester (you) via digital signature; otherwise it would be trivial to generate CSRs - and then certificates - with fake credentials, and spoof any existing entity.

  • 1
    I do not have access to the private key to generate the CSR, as it is in the remote device and I can only apply new certificate. Currently I have is only existing certificate. – vaibhav magar Oct 30 '15 at 12:48
  • 1
    You need to copy Subject DN (which can be a subset of the fields you listed) AND PUBLIC KEY, and sign the result. Note you don't need to write any code with (tagged) openssl since openssl x509 -x509toreq already does this. But as you say it needs privatekey to sign. – dave_thompson_085 Oct 30 '15 at 20:29
  • 1
    Hi Vaibhav, what sort of "remote device" is that ? Some appliance generate a private key and CSR then offer you to download the CSR. (they keep their private key secure but not providing access to it) – Florian Bidabe Jan 27 '16 at 21:41
  • 4
    +1 I agree that you need to prove possession of the private key in a csr, but I don't agree with your reason why: "otherwise it would be trivial to generate CSRs ... spoof any existing entity." - So I manage to get a cert that I don't have the private key for...how is that any different from grabbing the cert for google.com from my browser? It's fine that I have it because won't be able to actually use the cert for anything. – Mike Ounsworth Jan 27 '16 at 22:27
  • 3
    " as long as you have the private key, you can re-issue a new CSR by copying the fields ... from the existing certificate to the CSR." Yes, how do you do that, from the command line? – Otheus Apr 20 '16 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.