0

I went through the list of different StackExchange sites, and this seemed like the best place to ask this question, though if there's a better place please let me know!

I recently went through the process of getting an SSL/TLS certificate for a new email server. This was a fairly smooth process, and I understand the fundamentals behind it all.

I am also interested in getting an email certificate -- that is, a certificate that a program like Thunderbird can use to encrypt and decrypt emails. I do also have PGP keys, and yes I can use a plugin to encrypt the text and then email that, but this is partially for learning and partially for options.

Using Kleopatra, I am able to create a Certificate Request file (.p10). However, I cannot seem to find a single CA that mentions these files on their website. The one that Kleopatra/GPG recommend on their website is cacert.org, which actually looks like a great option -- except I cannot get it to generate a certificate. It keeps saying that it couldn't find a valid certificate request! Yet the wizard never even mentioned it or asked for it.

Has anyone here successfully created a certificate for signing/encrypting emails? I tried using one of the other free sevices, like Comodo, but because I don't have the private key that was used to create the certificate request, Thunderbird will not accept it. Hence going the Kleopatra route. There is a tutorial on the cacert website that uses a utility called XCA, however I was not able to import my existing keys into it as it won't accept ascii armor keys, and the other export options from GPG4Win are not acceptable import options in XCA. I really do not want to create a whole new key just for creating an email certificate, especially if I can't keep that key on my existing keychain.

Any thoughts, help or advice is extremely appreciated!

| improve this question | |
  • cacert.org is not default trusted CA by many browser and OS. – mootmoot Aug 19 '16 at 15:51
  • True. Until I'm in actual need of one, I'm not willing to shell out the cash for a big-name CA. However, I will definitely get a big-name CA when I do need one. My website uses StartCom which seem to be pretty good (Chrome immediately trusted them). – Aurelius Aug 19 '16 at 16:03
  • Now I'm facepalming. StartSSL (StartCom) actually have a utility for creating S/MIME certs... ugh. Now I'm thinking I should delete the cacert ones and create new ones... sigh. – Aurelius Aug 19 '16 at 16:06
  • But André Borie answer still works, you should generate your own private key and send the public key when request for new cert. XD – mootmoot Aug 19 '16 at 16:10
1

You should generate the private key and the derived CSR yourself. This is by design to prevent the CA from knowing your private key (they could generate everything themselves and give you an easy to use .p12, but that would compromise non-repudiation).

Using OpenSSL, you can generate a private key like this:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -aes-256-cbc -out mykey.key

This would encrypt the key - you'll need to enter its password each time a program accesses it.

To generate the CSR from the key do the following:

openssl req -new -out mycsr.csr -key mykey.key

Send it to your CA, and you should get a certificate back.

If you do not wish to encrypt the private key you can either omit the -aes-256-cbc argument from the first command or use this all-in-one command to generate a key and a CSR at the same time:

openssl req -new -out mycsr.csr -keyout mykey.key
| improve this answer | |
  • What format is the key generated by openssl in? ascii armor? pem? Still wrapping my head around all this. I do have openssl available through cygwin currently. I'd like to be able to keep that key in my existing keyring, if possible. – Aurelius Aug 19 '16 at 15:23
  • @Aurelius PEM format I believe. What do you mean by "existing keyring"? If you have an existing key you can just skip generating a new one and use your existing key when creating the CSR. – André Borie Aug 19 '16 at 15:25
  • I do have a few keys, in my existing GPG keyring. They are RSA keys. I suppose I could export the keys and use openssl to create a CSR? I'm just not sure that GPG4Win can export as PEM. Let me check. EDIT: It can only export as ASCII armor (duh, I should have remembered that) – Aurelius Aug 19 '16 at 15:38
  • @Aurelius OpenSSL could most likely use your GPG key. However, the mail application would also need access to the key in order to sign/encrypt messages, and it may not support using your GPG key. I suggest just making a different key. – André Borie Aug 19 '16 at 15:41
  • Yeah, it looks likes OpenSSL will only accept PEM as an input key for creating reqs. Alright, I just created a new key and req. After the certificate is made, is there even any reason to hold on to the key? I will be able to import the cert into GPG anyway... – Aurelius Aug 19 '16 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.