2

A TLS certificate is supposed to contain a copy of my public key, signed by a Certificate Authority.

But tutorials for creating a Certificate Signing Request show using a private key. Eg:

# generates a private key file
openssl genrsa -out domain.key 2048
# uses it to create a CSR
openssl req -key domain.key -new -out domain.csr

How can this work? I'm not giving my private key to the CA, right?

Improve this question
1
  • My guess is that openssl req derives the public key from the private one and uses that, but I'd like to confirm that guess. I know that deriving the private key from the public one is meant to be prohibitively expensive; maybe going the other direction is easy?
    – Nathan Long
    Jun 7, 2017 at 13:42

1 Answer 1

Reset to default
3

A CSR contains the public key as you correctly stated. But it is also signed by the private key as the proof that you actually own the public key in the CSR. This means that both the private key and public key is needed, i.e. the full key pair as generated by openssl genrsa.

Improve this answer
3
  • "the full key pair as generated by openssl genrsa" - my confusion was not knowing that this command generates a full key pair. The command prints "Generating RSA private key" to standard error, with no mention of the public key. And the generated file contains "BEGIN RSA PRIVATE KEY", some data, "END RSA PRIVATE KEY", and nothing else. Apparently the public key is contained in there, after all.
    – Nathan Long
    Jun 7, 2017 at 15:22
  • @NathanLong: It cannot create the private key only and then somehow compute the public key from the private key later. If this would be possible public key cryptography would be broken. Thus the "private key" in the file is actually the key pair.
    – Steffen Ullrich
    Jun 7, 2017 at 15:44
  • @Steffan Ullrich I knew it would be broken if you could compute the private key from the public, but I wasn't sure if computing the public from the private was possible.
    – Nathan Long
    Jun 7, 2017 at 16:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.