Questions about CAs and certificate requests

Question

I went through the list of different StackExchange sites, and this seemed like the best place to ask this question, though if there's a better place please let me know!

I recently went through the process of getting an SSL/TLS certificate for a new email server. This was a fairly smooth process, and I understand the fundamentals behind it all.

I am also interested in getting an email certificate -- that is, a certificate that a program like Thunderbird can use to encrypt and decrypt emails. I do also have PGP keys, and yes I can use a plugin to encrypt the text and then email that, but this is partially for learning and partially for options.

Using Kleopatra, I am able to create a Certificate Request file (.p10). However, I cannot seem to find a single CA that mentions these files on their website. The one that Kleopatra/GPG recommend on their website is cacert.org, which actually looks like a great option -- except I cannot get it to generate a certificate. It keeps saying that it couldn't find a valid certificate request! Yet the wizard never even mentioned it or asked for it.

Has anyone here successfully created a certificate for signing/encrypting emails? I tried using one of the other free sevices, like Comodo, but because I don't have the private key that was used to create the certificate request, Thunderbird will not accept it. Hence going the Kleopatra route. There is a tutorial on the cacert website that uses a utility called XCA, however I was not able to import my existing keys into it as it won't accept ascii armor keys, and the other export options from GPG4Win are not acceptable import options in XCA. I really do not want to create a whole new key just for creating an email certificate, especially if I can't keep that key on my existing keychain.

Any thoughts, help or advice is extremely appreciated!

Answer 1

You should generate the private key and the derived CSR yourself. This is by design to prevent the CA from knowing your private key (they could generate everything themselves and give you an easy to use .p12, but that would compromise non-repudiation).

Using OpenSSL, you can generate a private key like this:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -aes-256-cbc -out mykey.key

This would encrypt the key - you'll need to enter its password each time a program accesses it.

To generate the CSR from the key do the following:

openssl req -new -out mycsr.csr -key mykey.key

Send it to your CA, and you should get a certificate back.

If you do not wish to encrypt the private key you can either omit the -aes-256-cbc argument from the first command or use this all-in-one command to generate a key and a CSR at the same time:

openssl req -new -out mycsr.csr -keyout mykey.key