1

I have a SSL certificate that is due to expire very soon and I need to generate a CSR in order to get my certificate renewed.

I have the private key pem file on hand and I have set myself up to run the following command.

openssl req -out codesigning.csr -key my-company-apps-Private-Key.pem -new

When I run this command it is asking me for the following...

Country Name: State Name: Locality Name: Organization Name: Organizational Unit Name: Common Name: Email Address Challenge Password: Company Name:

The guy who generated the initial CSR has left the company and I havce no idea what he would have put in for these answers on the original CSR.

Do the questions to these answers matter for the CSR?

Is there anyway I can find out this information using the original certificate?

Any other guidance would be welcome.

thanks in advance.

  • Is this for SSL or Code Signing? – Bryan Field Oct 4 '16 at 15:49
0

I downloaded the certificate of the wikipedia website. Then I executed

openssl x509 -text -in star.wikipedia.org.crt -inform PEM

and it prints out a lot of stuff. Below I think you can find the relevant pieces of information:

kai@MYHOST:~$ openssl x509 -text -in star.wikipedia.org.crt -inform PEM
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:21:a2:25:ba:04:02:d7:91:85:48:54:c8:ba:60:68:6a:9b
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2
        Validity
            Not Before: Dec 10 23:22:05 2015 GMT
            Not After : Dec 10 22:46:04 2016 GMT
====>  Subject: C=US, ST=California, L=San Francisco, O=Wikimedia Foundation, Inc., CN=*.wikipedia.org
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub: 
                    04:cb:db:d0:46:41:79:b8:d3:6e:2e:c8:5c:32:d3:
                    f7:82:44:c4:5b:6d:36:51:1b:e6:8f:29:34:92:fe:
                    7c:32:65:8f:23:fd:18:82:b2:35:40:13:fd:7a:c1:
                    ce:c8:3a:da:52:19:93:10:0b:aa:59:1a:f0:f3:8b:
                    ef:dc:7b:0b:fd
                ASN1 OID: prime256v1
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.2
                  CPS: https://www.globalsign.com/repository/

            X509v3 Subject Alternative Name:
[...Snip...]

I have marked the relevant section. It says basically

Country = US
State = California
Location = San Francisco
Organization = Wikimedia Foundation, Inc.
Common Name=*.wikipedia.org

You can do the same with your old certificate and then you know exactly what you need to enter in the CSR.
The purpose of this is to provide an identity description the CA can vouch for. The format to describe the identity is taken from the X.500 directory standard which uses those C, L, OU, etc. tokens.
It's probably a good idea to enter the same values from the previous certificate. In case company name or location has changed and you want to reflect that in the X.500 name then your CA will probably start some kind of process to verify that the new name is accurate...

1

CN and SAN both matter, as there are RFIs that require identifier matching. For example, for TLS RFC 6125. So be deliberate with these. For other fields it matters less, so just copy what you have in your old certificate.

Before you generate CSR, I recommend verifying that you have 2048-bit or better key. You can do this by running:

$ openssl x509 -in public.pem -text -noout | grep "RSA Public Key" RSA

Also, consider including basicConstraints and extendedKeyUsage extensions.

0

All of this can be extracted from your previous certificate, simply by using the View Certificate feature in your favorite Browser, once you visit the https URL of your site.

However, the only one that really matters is Common Name. This is the domain name which needs to be secured.

All the others can change on each renewal.

If you have SAN domains (alternate domain names, see this question for an example image) then those will have to be configured, but that is a subject for a different question.

I don't think you should use a Challenge Password. I've not heard of this being used in a CSR.

  • 1
    once you visit the https URL of your site. The question is about codesigning certificate, not about SSL. – Crypt32 Oct 4 '16 at 14:56
  • The OP should clarify then. "I have a SSL certificate that is due to expire very soon and I need to generate a CSR in order to get my certificate renewed." made me think it was for HTTPS, but I now see the code sample says codesigning.csr. – Bryan Field Oct 4 '16 at 15:25
  • I am confused about how renewals work on codesigning certificates, since the code should theoretically remain 'signed' for the lifetime of the application? – Bryan Field Oct 4 '16 at 15:27
  • it works in the same way. Signature lifetime is extended beyond signing cert lifetime by using timestamping: sysadmins.lv/blog-en/digital-signatures.aspx – Crypt32 Oct 4 '16 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.