So I have been doing my research and haven't found anything specific enough to my problem. As the question title states, I want to make a CSR with only the public key. What I have been able to do is generate a CSR with the information of my choosing along with a new keypair. And then use something like this to force it to use the public key I want when making the certificate.

openssl x509 -req -in mycsr.pem -force_pubkey mypubkey.pem -CA dumyCA.pem -CAkey -dumyCA.pem -out mycert.pem

After this I take the outputted certificate and change its attributes to associate it with a private key. This all works nicely. The problem with this is that if I were to take the said csr, and submit it to a CA they would return to me a certificate that used the key that was generated when the csr is generate. Thus my question.

EDIT: So I have a key-pair, but my private key is on an HSM module that doesn't have export capabilities. I am able to get a .pem file of the public key. And after making the certificate with the command I gave I run it through a program that associates it with the private key. So my new question is, using openssl API will I be able to create my own csr? So I can sign it with the private key without having to have it in a file, and associate it with the public key I have.

  • For sake of anyone else who tries to parse this question. -force_pubkey key option: when a certificate is created set its public key to key instead of the key in the certificate or certificate request. This option is useful for creating certificates where the algorithm can't normally sign requests, for example DH. – kubanczyk Mar 3 '16 at 9:40
  • 2
    What you asked is impossible because csr must be signed with the private key. – Cthulhu Mar 3 '16 at 9:51
  • Sorry for late reply. If I have a different certificate with the corresponding key that the csr will require, can I sign it with that? – embasa Mar 3 '16 at 19:09
  • From the comments here and on the answer, it is unclear what you are asking for. Please edit the question to clarify what you really want. A "CSR with only the public key" is the public key itself. And no CSR can be made without signing the content, which requires access to the private key (that's the whole point of it, to avoid CSR forging - plus that is how asymmetric cryptography works). – M'vy Mar 4 '16 at 8:52
  • I came across the same problem. @Cthulhu that's fair enough. Thanks for pointing out. – qweruiop Sep 15 '17 at 3:26

The Certificate Signing Request, as generated by the command :

openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key

Will include your public key. This is mandatory as per the PKI process. The CSR, containing your entity information and the public key is send to any Certificate Authority you like for a request of certificate (hence the CSR name). The CSR is signed using the private key that is linked to the embedded public key.

The CA, after assessing your identity will basically sign the CSR to create a valid certificate for you. This is the certificate you will send to clients, e.g. when they connect to your website.

The private key in your privateKey.key file will be used by your webserver to decrypt messages send to it. This private key should never, ever leave the server.

You can check the Most common openSSL commands for more information.

  • I know this, and I read through that entire link you posted before asking. I am looking for a not-so-common way. Maybe using openssl API in c or something. – embasa Mar 3 '16 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.