I am reading http://www.akadia.com/services/ssh_test_certificate.html

In step 2

openssl req -new -key server.key -out server.csr

server.key is generated earlier using

openssl genrsa -des3 -out server.key 1024 

which is the private key.

I do not see any public key being "attached" into the CSR.

Am i missing anything ?


(newly added)

I have opened the csr using vi as well as openssl reg and this is what i saw

bash-3.2# openssl req -in server.csr

It seems like the CSR is encoded with some format or is this a hash, if it is , how does the CA verify what's inside ??

I am hopefully sure that it is not encrypted with any key because removing the "server.key", i am still see the CSR in text output with

bash-3.2# openssl req -in server.csr -text

Please enlighten me.

  • The PubKey is a PART of the PrivKey when using that particular storage format. (Sounds weird, I know.) You can extract the pubkey part from the privkey at any time. So the pubkey IS attached. Jan 19, 2016 at 17:11
  • @StackzOfZtuff do you mean 1) the "server.key" contains both the private and public key ? 2) and during the generation of the csr , the "public key" in the "server.key" is :"attached/included" within the crs ?
    – Noob
    Jan 20, 2016 at 3:41
  • 1
    To display the contents of the CSR, use openssl req -in server.csr -noout -text. You will see that it contains the Subject name which is the name of the server in the 'Distinguished Name' format used by X.500 series, Subject Public Key Info, and a Signature which is created using but does not include the private (parts of the) key. Also your title is confusing because this does not create a selfsigned cert yet and maybe not at all because as the webpage correctly says you can use this CSR to get a cert from a "real" (well-known) CA. Jan 20, 2016 at 5:58

1 Answer 1


I do not see any public key being "attached" into the CSR.

It's there. Here's where:

When you generate your key like so:

$ openssl genrsa -out server.key 1024
Generating RSA private key, 1024 bit long modulus
e is 65537 (0x10001)

And you generate your CSR like so:

$ openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:dummy.example.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Then the public key will be inside the both the:

  1. Private Key file:

    $ openssl rsa -in server.key -pubout
    writing RSA key
    -----BEGIN PUBLIC KEY-----
    -----END PUBLIC KEY-----
  2. CSR file:

    $ openssl req -in server.csr -noout -pubkey
    -----BEGIN PUBLIC KEY-----
    -----END PUBLIC KEY-----
  • wonderful ! just out of curiosity , -noout this option prevents output of the encoded version of the request. - what does it means ?
    – Noob
    Jan 20, 2016 at 9:56
  • The -noout option suppresses the usual "just output everything" default mode of OpenSSL. Try yourself. Jan 20, 2016 at 10:36
  • thanks for the wonderful example. i have 1 last question and i have edited my original post, please take alook if you will, its with regards to the output of the csr.
    – Noob
    Jan 20, 2016 at 15:33
  • @Noob the file format used by many (not all) openssl functions is called "PEM" format and based on tools.ietf.org/html/rfc1421 with some modifications. It consists of header and trailer lines with 5 dashes, BEGIN/END, an all-cap type name, and 5 dashes containing sometimes a few rfc822-style header lines and always line-wrapped base64 encoding of the ASN.1 BER or DER encoding of whatever data type is applicable for the data being stored. Thus your CSR file is a BEGIN line, wrapped base64 of ASN.1 CertificationRequest per tools.ietf.org/html/rfc2986 and an END line. Jan 21, 2016 at 8:17
  • 1
    PS: openssl asn1parse can take any PEM-of-BER/DER or binary BER/DER file (specify -inform der for the latter; in OpenSSL der really means 'binary' not strictly DER) and display the ASN.1 structure. There are lots of other ASN.1 tools around, although you may need to "de-PEM" (delete the header/trailer lines and convert from base64) separately. Jan 21, 2016 at 8:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .