6

I am reading http://www.akadia.com/services/ssh_test_certificate.html

In step 2

openssl req -new -key server.key -out server.csr

server.key is generated earlier using

openssl genrsa -des3 -out server.key 1024 

which is the private key.

I do not see any public key being "attached" into the CSR.

Am i missing anything ?

=================

(newly added)

I have opened the csr using vi as well as openssl reg and this is what i saw

bash-3.2# openssl req -in server.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIC7DCCAdQCAQAwgaYxCzAJBgNVBAYTAlNHMRIwEAYDVQQIDAlTaW5nYXBvcmUx
ETAPBgNVBAcMCENsZW1lbnRpMR0wGwYDVQQKDBRPcmFjbGVTemVqaWUgUHRlIEx0
ZDELMAkGA1UECwwCSVQxHTAbBgNVBAMMFHd3dy5vcmFjbGVzemVqaWUuY29tMSUw
IwYJKoZIhvcNAQkBFhZhZG1pbkBvcmFjbGVzemVqaWUuY29tMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3B0IpI7mO1ZNn19V8R0voG3pQuuenzPvomfl
ipjidlvA4oF2486n0Apf8eLudtEBin70CVQ6xx/BYISv/SQqklIrRnhNnTyWsuxy
ofJRyrZyuWVyHo9LX9ARvUuBDXHLNHTepKX3ntsg/4H1o+wl0ZV3/ixj43wj7oNe
bxPEGHldmeaFwRonWXCTp9tXoZOa6agKY8ItSAWytYu2FBY33CXaTNSI2J/bLIVT
sJqJoL1nra35xq9fzyrclcDXVF3gqmOv2zRAUShxp+wtjGmA6e6iA3uM6NxHNrDN
0v3sDEpoDlkeMmTTxY/51QHfmy4HR3oRfdR6ERyx9pYdapPUiQIDAQABoAAwDQYJ
KoZIhvcNAQEFBQADggEBADyDRmogcQsYp6D4I3Mecicw16Miula4b4HfALaF6hwc
Ml9wUCRSBkjrgHIqva7RTx6LLNwcpDBA0V3S6o0HfN4uS8z+IKQ6VMVyk7pVcKcv
PFrZM1oW3oRd/eTU1B7+c98fQMazFfitT5fnTD5Zt+laL+9qutQtVRT/tnKrEX2p
irgBnZuXuOszzcmkI2XPh/eCudGC2es13pcdyHII+6Q5PzwM58ssNziDiLXZU7pD
0mDdIWmF1RBed7GCK9gYvYmnw+20VzRHvWpVEe2sdBlgAQH34xxWX2130vzk6crJ
6K0cP8kc8S2H8iOZ4hQWewrCebntZQNO9ythvOuik4c=
-----END CERTIFICATE REQUEST-----

It seems like the CSR is encoded with some format or is this a hash, if it is , how does the CA verify what's inside ??

I am hopefully sure that it is not encrypted with any key because removing the "server.key", i am still see the CSR in text output with

bash-3.2# openssl req -in server.csr -text

Please enlighten me.

3
  • The PubKey is a PART of the PrivKey when using that particular storage format. (Sounds weird, I know.) You can extract the pubkey part from the privkey at any time. So the pubkey IS attached. Jan 19, 2016 at 17:11
  • @StackzOfZtuff do you mean 1) the "server.key" contains both the private and public key ? 2) and during the generation of the csr , the "public key" in the "server.key" is :"attached/included" within the crs ?
    – Noob
    Jan 20, 2016 at 3:41
  • 1
    To display the contents of the CSR, use openssl req -in server.csr -noout -text. You will see that it contains the Subject name which is the name of the server in the 'Distinguished Name' format used by X.500 series, Subject Public Key Info, and a Signature which is created using but does not include the private (parts of the) key. Also your title is confusing because this does not create a selfsigned cert yet and maybe not at all because as the webpage correctly says you can use this CSR to get a cert from a "real" (well-known) CA. Jan 20, 2016 at 5:58

1 Answer 1

13

I do not see any public key being "attached" into the CSR.

It's there. Here's where:

When you generate your key like so:

$ openssl genrsa -out server.key 1024
Generating RSA private key, 1024 bit long modulus
....................................++++++
......++++++
e is 65537 (0x10001)

And you generate your CSR like so:

$ openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:dummy.example.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Then the public key will be inside the both the:

  1. Private Key file:

    $ openssl rsa -in server.key -pubout
    writing RSA key
    -----BEGIN PUBLIC KEY-----
    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4IPFCBOLLyJWtx37bibBKhKvE
    9MbfD0MV8bXU544dVXvWZwLQwluyrsYebpl+4K1aLNmh01qUwBsm4GxESZo4mF3L
    13Yki7Xlw95KJVgDBN0i1j96LgaxV/4K8z4RQ1MryGw+EHYFK/5pwtLxGN7Rn7kB
    L9HOPEkwfwWbenUikQIDAQAB
    -----END PUBLIC KEY-----
    
  2. CSR file:

    $ openssl req -in server.csr -noout -pubkey
    -----BEGIN PUBLIC KEY-----
    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4IPFCBOLLyJWtx37bibBKhKvE
    9MbfD0MV8bXU544dVXvWZwLQwluyrsYebpl+4K1aLNmh01qUwBsm4GxESZo4mF3L
    13Yki7Xlw95KJVgDBN0i1j96LgaxV/4K8z4RQ1MryGw+EHYFK/5pwtLxGN7Rn7kB
    L9HOPEkwfwWbenUikQIDAQAB
    -----END PUBLIC KEY-----
    
6
  • wonderful ! just out of curiosity , -noout this option prevents output of the encoded version of the request. - what does it means ?
    – Noob
    Jan 20, 2016 at 9:56
  • The -noout option suppresses the usual "just output everything" default mode of OpenSSL. Try yourself. Jan 20, 2016 at 10:36
  • thanks for the wonderful example. i have 1 last question and i have edited my original post, please take alook if you will, its with regards to the output of the csr.
    – Noob
    Jan 20, 2016 at 15:33
  • @Noob the file format used by many (not all) openssl functions is called "PEM" format and based on tools.ietf.org/html/rfc1421 with some modifications. It consists of header and trailer lines with 5 dashes, BEGIN/END, an all-cap type name, and 5 dashes containing sometimes a few rfc822-style header lines and always line-wrapped base64 encoding of the ASN.1 BER or DER encoding of whatever data type is applicable for the data being stored. Thus your CSR file is a BEGIN line, wrapped base64 of ASN.1 CertificationRequest per tools.ietf.org/html/rfc2986 and an END line. Jan 21, 2016 at 8:17
  • 1
    PS: openssl asn1parse can take any PEM-of-BER/DER or binary BER/DER file (specify -inform der for the latter; in OpenSSL der really means 'binary' not strictly DER) and display the ASN.1 structure. There are lots of other ASN.1 tools around, although you may need to "de-PEM" (delete the header/trailer lines and convert from base64) separately. Jan 21, 2016 at 8:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .