I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, use that to generate a CSR with openssl
and then bundle the two into a PKCS12 certificate, also using openssl
.
My question is, how secure is this? How well protected is the private key within the PKCS12 and what openssl
commands should I use to ensure the best level of security for the key?
Bear in mind that I intend on using my signing-only private subkey for the certificate instead of the master one.