3

I am reading http://www.akadia.com/services/ssh_test_certificate.html

In step 2

openssl req -new -key server.key -out server.csr

server.key is generated earlier using

openssl genrsa -des3 -out server.key 1024 

which is the private key.

I do not see any public key being "attached" into the CSR.

Am i missing anything ?

=================

(newly added)

I have opened the csr using vi as well as openssl reg and this is what i saw

bash-3.2# openssl req -in server.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIC7DCCAdQCAQAwgaYxCzAJBgNVBAYTAlNHMRIwEAYDVQQIDAlTaW5nYXBvcmUx
ETAPBgNVBAcMCENsZW1lbnRpMR0wGwYDVQQKDBRPcmFjbGVTemVqaWUgUHRlIEx0
ZDELMAkGA1UECwwCSVQxHTAbBgNVBAMMFHd3dy5vcmFjbGVzemVqaWUuY29tMSUw
IwYJKoZIhvcNAQkBFhZhZG1pbkBvcmFjbGVzemVqaWUuY29tMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3B0IpI7mO1ZNn19V8R0voG3pQuuenzPvomfl
ipjidlvA4oF2486n0Apf8eLudtEBin70CVQ6xx/BYISv/SQqklIrRnhNnTyWsuxy
ofJRyrZyuWVyHo9LX9ARvUuBDXHLNHTepKX3ntsg/4H1o+wl0ZV3/ixj43wj7oNe
bxPEGHldmeaFwRonWXCTp9tXoZOa6agKY8ItSAWytYu2FBY33CXaTNSI2J/bLIVT
sJqJoL1nra35xq9fzyrclcDXVF3gqmOv2zRAUShxp+wtjGmA6e6iA3uM6NxHNrDN
0v3sDEpoDlkeMmTTxY/51QHfmy4HR3oRfdR6ERyx9pYdapPUiQIDAQABoAAwDQYJ
KoZIhvcNAQEFBQADggEBADyDRmogcQsYp6D4I3Mecicw16Miula4b4HfALaF6hwc
Ml9wUCRSBkjrgHIqva7RTx6LLNwcpDBA0V3S6o0HfN4uS8z+IKQ6VMVyk7pVcKcv
PFrZM1oW3oRd/eTU1B7+c98fQMazFfitT5fnTD5Zt+laL+9qutQtVRT/tnKrEX2p
irgBnZuXuOszzcmkI2XPh/eCudGC2es13pcdyHII+6Q5PzwM58ssNziDiLXZU7pD
0mDdIWmF1RBed7GCK9gYvYmnw+20VzRHvWpVEe2sdBlgAQH34xxWX2130vzk6crJ
6K0cP8kc8S2H8iOZ4hQWewrCebntZQNO9ythvOuik4c=
-----END CERTIFICATE REQUEST-----

It seems like the CSR is encoded with some format or is this a hash, if it is , how does the CA verify what's inside ??

I am hopefully sure that it is not encrypted with any key because removing the "server.key", i am still see the CSR in text output with

bash-3.2# openssl req -in server.csr -text

Please enlighten me.

  • The PubKey is a PART of the PrivKey when using that particular storage format. (Sounds weird, I know.) You can extract the pubkey part from the privkey at any time. So the pubkey IS attached. – StackzOfZtuff Jan 19 '16 at 17:11
  • @StackzOfZtuff do you mean 1) the "server.key" contains both the private and public key ? 2) and during the generation of the csr , the "public key" in the "server.key" is :"attached/included" within the crs ? – Noob Jan 20 '16 at 3:41
  • 1
    To display the contents of the CSR, use openssl req -in server.csr -noout -text. You will see that it contains the Subject name which is the name of the server in the 'Distinguished Name' format used by X.500 series, Subject Public Key Info, and a Signature which is created using but does not include the private (parts of the) key. Also your title is confusing because this does not create a selfsigned cert yet and maybe not at all because as the webpage correctly says you can use this CSR to get a cert from a "real" (well-known) CA. – dave_thompson_085 Jan 20 '16 at 5:58
8

I do not see any public key being "attached" into the CSR.

It's there. Here's where:

When you generate your key like so:

$ openssl genrsa -out server.key 1024
Generating RSA private key, 1024 bit long modulus
....................................++++++
......++++++
e is 65537 (0x10001)

And you generate your CSR like so:

$ openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:dummy.example.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Then the public key will be inside the both the:

  1. Private Key file:

    $ openssl rsa -in server.key -pubout
    writing RSA key
    -----BEGIN PUBLIC KEY-----
    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4IPFCBOLLyJWtx37bibBKhKvE
    9MbfD0MV8bXU544dVXvWZwLQwluyrsYebpl+4K1aLNmh01qUwBsm4GxESZo4mF3L
    13Yki7Xlw95KJVgDBN0i1j96LgaxV/4K8z4RQ1MryGw+EHYFK/5pwtLxGN7Rn7kB
    L9HOPEkwfwWbenUikQIDAQAB
    -----END PUBLIC KEY-----
    
  2. CSR file:

    $ openssl req -in server.csr -noout -pubkey
    -----BEGIN PUBLIC KEY-----
    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4IPFCBOLLyJWtx37bibBKhKvE
    9MbfD0MV8bXU544dVXvWZwLQwluyrsYebpl+4K1aLNmh01qUwBsm4GxESZo4mF3L
    13Yki7Xlw95KJVgDBN0i1j96LgaxV/4K8z4RQ1MryGw+EHYFK/5pwtLxGN7Rn7kB
    L9HOPEkwfwWbenUikQIDAQAB
    -----END PUBLIC KEY-----
    
  • wonderful ! just out of curiosity , -noout this option prevents output of the encoded version of the request. - what does it means ? – Noob Jan 20 '16 at 9:56
  • The -noout option suppresses the usual "just output everything" default mode of OpenSSL. Try yourself. – StackzOfZtuff Jan 20 '16 at 10:36
  • thanks for the wonderful example. i have 1 last question and i have edited my original post, please take alook if you will, its with regards to the output of the csr. – Noob Jan 20 '16 at 15:33
  • @Noob the file format used by many (not all) openssl functions is called "PEM" format and based on tools.ietf.org/html/rfc1421 with some modifications. It consists of header and trailer lines with 5 dashes, BEGIN/END, an all-cap type name, and 5 dashes containing sometimes a few rfc822-style header lines and always line-wrapped base64 encoding of the ASN.1 BER or DER encoding of whatever data type is applicable for the data being stored. Thus your CSR file is a BEGIN line, wrapped base64 of ASN.1 CertificationRequest per tools.ietf.org/html/rfc2986 and an END line. – dave_thompson_085 Jan 21 '16 at 8:17
  • PS: openssl asn1parse can take any PEM-of-BER/DER or binary BER/DER file (specify -inform der for the latter; in OpenSSL der really means 'binary' not strictly DER) and display the ASN.1 structure. There are lots of other ASN.1 tools around, although you may need to "de-PEM" (delete the header/trailer lines and convert from base64) separately. – dave_thompson_085 Jan 21 '16 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.