I went through the list of different StackExchange sites, and this seemed like the best place to ask this question, though if there's a better place please let me know!

I recently went through the process of getting an SSL/TLS certificate for a new email server. This was a fairly smooth process, and I understand the fundamentals behind it all.

I am also interested in getting an email certificate -- that is, a certificate that a program like Thunderbird can use to encrypt and decrypt emails. I do also have PGP keys, and yes I can use a plugin to encrypt the text and then email that, but this is partially for learning and partially for options.

Using Kleopatra, I am able to create a Certificate Request file (.p10). However, I cannot seem to find a single CA that mentions these files on their website. The one that Kleopatra/GPG recommend on their website is cacert.org, which actually looks like a great option -- except I cannot get it to generate a certificate. It keeps saying that it couldn't find a valid certificate request! Yet the wizard never even mentioned it or asked for it.

Has anyone here successfully created a certificate for signing/encrypting emails? I tried using one of the other free sevices, like Comodo, but because I don't have the private key that was used to create the certificate request, Thunderbird will not accept it. Hence going the Kleopatra route. There is a tutorial on the cacert website that uses a utility called XCA, however I was not able to import my existing keys into it as it won't accept ascii armor keys, and the other export options from GPG4Win are not acceptable import options in XCA. I really do not want to create a whole new key just for creating an email certificate, especially if I can't keep that key on my existing keychain.

Any thoughts, help or advice is extremely appreciated!

  • cacert.org is not default trusted CA by many browser and OS.
    – mootmoot
    Aug 19, 2016 at 15:51
  • True. Until I'm in actual need of one, I'm not willing to shell out the cash for a big-name CA. However, I will definitely get a big-name CA when I do need one. My website uses StartCom which seem to be pretty good (Chrome immediately trusted them).
    – Aurelius
    Aug 19, 2016 at 16:03
  • Now I'm facepalming. StartSSL (StartCom) actually have a utility for creating S/MIME certs... ugh. Now I'm thinking I should delete the cacert ones and create new ones... sigh.
    – Aurelius
    Aug 19, 2016 at 16:06
  • But André Borie answer still works, you should generate your own private key and send the public key when request for new cert. XD
    – mootmoot
    Aug 19, 2016 at 16:10

1 Answer 1


You should generate the private key and the derived CSR yourself. This is by design to prevent the CA from knowing your private key (they could generate everything themselves and give you an easy to use .p12, but that would compromise non-repudiation).

Using OpenSSL, you can generate a private key like this:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -aes-256-cbc -out mykey.key

This would encrypt the key - you'll need to enter its password each time a program accesses it.

To generate the CSR from the key do the following:

openssl req -new -out mycsr.csr -key mykey.key

Send it to your CA, and you should get a certificate back.

If you do not wish to encrypt the private key you can either omit the -aes-256-cbc argument from the first command or use this all-in-one command to generate a key and a CSR at the same time:

openssl req -new -out mycsr.csr -keyout mykey.key
  • What format is the key generated by openssl in? ascii armor? pem? Still wrapping my head around all this. I do have openssl available through cygwin currently. I'd like to be able to keep that key in my existing keyring, if possible.
    – Aurelius
    Aug 19, 2016 at 15:23
  • @Aurelius PEM format I believe. What do you mean by "existing keyring"? If you have an existing key you can just skip generating a new one and use your existing key when creating the CSR. Aug 19, 2016 at 15:25
  • I do have a few keys, in my existing GPG keyring. They are RSA keys. I suppose I could export the keys and use openssl to create a CSR? I'm just not sure that GPG4Win can export as PEM. Let me check. EDIT: It can only export as ASCII armor (duh, I should have remembered that)
    – Aurelius
    Aug 19, 2016 at 15:38
  • @Aurelius OpenSSL could most likely use your GPG key. However, the mail application would also need access to the key in order to sign/encrypt messages, and it may not support using your GPG key. I suggest just making a different key. Aug 19, 2016 at 15:41
  • Yeah, it looks likes OpenSSL will only accept PEM as an input key for creating reqs. Alright, I just created a new key and req. After the certificate is made, is there even any reason to hold on to the key? I will be able to import the cert into GPG anyway...
    – Aurelius
    Aug 19, 2016 at 15:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .