I want to create a self-signed certificate to digitally sign my documents. I want to do so using my existing key pair, but to accomplish this I'd have to export my private key unencrypted into a file, use that to generate a CSR with openssl and then bundle the two into a PKCS12 certificate, also using openssl.

My question is, how secure is this? How well protected is the private key within the PKCS12 and what openssl commands should I use to ensure the best level of security for the key?

Bear in mind that I intend on using my signing-only private subkey for the certificate instead of the master one.

1 Answer 1


Well, in the final PKCS12 you should encrypt the private key. The pkcs12 utility allows you to specify how you want to encrypt the private key.

-aes128, -aes192, -aes256
use AES to encrypt private keys before outputting.

-camellia128, -camellia192, -camellia256
use Camellia to encrypt private keys before outputting.

I would consider aes256 very secure for a private key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.