I am reading http://www.akadia.com/services/ssh_test_certificate.html

In step 2

openssl req -new -key server.key -out server.csr

server.key is generated earlier using

openssl genrsa -des3 -out server.key 1024 

which is the private key.

I do not see any public key being "attached" into the CSR.

Am i missing anything ?


(newly added)

I have opened the csr using vi as well as openssl reg and this is what i saw

bash-3.2# openssl req -in server.csr

It seems like the CSR is encoded with some format or is this a hash, if it is , how does the CA verify what's inside ??

I am hopefully sure that it is not encrypted with any key because removing the "server.key", i am still see the CSR in text output with

bash-3.2# openssl req -in server.csr -text

Please enlighten me.

  • The PubKey is a PART of the PrivKey when using that particular storage format. (Sounds weird, I know.) You can extract the pubkey part from the privkey at any time. So the pubkey IS attached. – StackzOfZtuff Jan 19 '16 at 17:11
  • @StackzOfZtuff do you mean 1) the "server.key" contains both the private and public key ? 2) and during the generation of the csr , the "public key" in the "server.key" is :"attached/included" within the crs ? – Noob Jan 20 '16 at 3:41
  • 1
    To display the contents of the CSR, use openssl req -in server.csr -noout -text. You will see that it contains the Subject name which is the name of the server in the 'Distinguished Name' format used by X.500 series, Subject Public Key Info, and a Signature which is created using but does not include the private (parts of the) key. Also your title is confusing because this does not create a selfsigned cert yet and maybe not at all because as the webpage correctly says you can use this CSR to get a cert from a "real" (well-known) CA. – dave_thompson_085 Jan 20 '16 at 5:58

I do not see any public key being "attached" into the CSR.

It's there. Here's where:

When you generate your key like so:

$ openssl genrsa -out server.key 1024
Generating RSA private key, 1024 bit long modulus
e is 65537 (0x10001)

And you generate your CSR like so:

$ openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:dummy.example.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Then the public key will be inside the both the:

  1. Private Key file:

    $ openssl rsa -in server.key -pubout
    writing RSA key
    -----BEGIN PUBLIC KEY-----
    -----END PUBLIC KEY-----
  2. CSR file:

    $ openssl req -in server.csr -noout -pubkey
    -----BEGIN PUBLIC KEY-----
    -----END PUBLIC KEY-----
  • wonderful ! just out of curiosity , -noout this option prevents output of the encoded version of the request. - what does it means ? – Noob Jan 20 '16 at 9:56
  • The -noout option suppresses the usual "just output everything" default mode of OpenSSL. Try yourself. – StackzOfZtuff Jan 20 '16 at 10:36
  • thanks for the wonderful example. i have 1 last question and i have edited my original post, please take alook if you will, its with regards to the output of the csr. – Noob Jan 20 '16 at 15:33
  • @Noob the file format used by many (not all) openssl functions is called "PEM" format and based on tools.ietf.org/html/rfc1421 with some modifications. It consists of header and trailer lines with 5 dashes, BEGIN/END, an all-cap type name, and 5 dashes containing sometimes a few rfc822-style header lines and always line-wrapped base64 encoding of the ASN.1 BER or DER encoding of whatever data type is applicable for the data being stored. Thus your CSR file is a BEGIN line, wrapped base64 of ASN.1 CertificationRequest per tools.ietf.org/html/rfc2986 and an END line. – dave_thompson_085 Jan 21 '16 at 8:17
  • PS: openssl asn1parse can take any PEM-of-BER/DER or binary BER/DER file (specify -inform der for the latter; in OpenSSL der really means 'binary' not strictly DER) and display the ASN.1 structure. There are lots of other ASN.1 tools around, although you may need to "de-PEM" (delete the header/trailer lines and convert from base64) separately. – dave_thompson_085 Jan 21 '16 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.