Find private key from private certificate

Question

I have a private certificate from my email server in order to sign emails. At Section "Your S/MIME Personal Certificate" I can view my:

• private certificate
• public certificate

My public certificate starts with:

-----BEGIN CERTIFICATE-----

My private certificate starts with:

Key Attributes
    X509v3 Key Usage: 10 
-----BEGIN ENCRYPTED PRIVATE KEY-----

This private certificate contains a private key?
If yes is there any way to find it?

Answer 1

First of all, there are no private certificates. There are only private keys.

This is private key, but only in its encrypted form:

Key Attributes
    X509v3 Key Usage: 10 
-----BEGIN ENCRYPTED PRIVATE KEY-----

You are able decrypt that and you will get your private key. A common tool for this is for example OpenSSL.

Answer 2

The private key is right there after this line -----BEGIN ENCRYPTED PRIVATE KEY-----

Encrypted means it is protected (encrypted) with the password of the private key. You should have this. The result of the encryption of the password + the original private key is the encrypted key in your X.509 certificate. You can decrypt it with your password and use the key.

Did you try to import the certificates into your email client or encryption software which manages the keys?

This is all defined in the corresponding RFCs, see here http://www.cryptosys.net/pki/rsakeyformats.html

Creating a new key pair

The function RSA_MakeKeys creates a new RSA key pair in two files, one for the public key and one for the private key. The private key is saved in encrypted form, protected by a password supplied by the user, so it is never saved explicitly to disk in the clear.