0

I have seen it various times on different products when configuring a SSL certificate for the web gui, where it's written that the Private Key is optional. Isn't that client (borwser) sending data encrypted with the servers public key and the server verifies (decrypts) with it's private key ?

enter image description here

Improve this question

2 Answers 2

Reset to default
2

I have no idea what the GUI you've shown is exactly for. But, for a server certificate in HTTPS the private key is always needed. Contrary to your statement the private key is not used by the server to decrypt client data (only kind of when RSA key exchange is used) but to sign a challenge based on client data in order to authenticate itself.

Improve this answer
2
  • It is a CISCO Firer Power system. Please exuse my mistake, basically what you wrote is what I was trying to say. In the picture, in the right corner you can see a "Generate New CSR" button. When I click on, I'm asked for the "Common Name", "Organization" etc. Just wondering, if the private key is automatically generated in the background and kept on the system? Is it possible ?
    – cyzczy
    Sep 13, 2017 at 11:50
  • @adam86: might be. I suggest to look at the documentation for the system to find out more.
    – Steffen Ullrich
    Sep 13, 2017 at 13:27
0

When a new CSR is generated to be signed by a CA, you have the option to use the old private key or generate a new one. I expect that is what this is for.

Generally, it is good practice to use a new one (leave this blank) in order to rotate your private key, in case it has been compromised at some point.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .