2

I have a small PKI for our web server that will require client certificates.

When generating the private key for CSR (edit: CSR for a client certificate ), I can do it with or without a pass phrase.

What is the importance of using a pass phrase (or not)?.

EDIT 2: For my setup, I will be giving users a PFX/P12 file, which will have an export/import passphrase, since the only passphrase I used when importing a client certificate was the "export" passphrase, I guess the private key is included in the PFX/P12?

if so, there's not much difference for me to whether I use a passphrase for the key or not, right?

So if all above is right, , why would I want to protect the private key?

1

The passphrase is used to protect and encrypt the private key. You will create the private key either encrypted or not. If you encrypt the private key, it must be decrypted before use in any transaction with that passphrase. Doing this provides an additional layer of protection over that key.

A quick read of this document will be helpful: OpenSSL Essentials

  • I failed to mention that the CSR I'm talking about is for generating the client certificate. The question is what is the point on securing they private key? I tried creating a certificate and export it as PFX/P12 file and then importing it as user, the only passphrase I was required was the one I set for the export, but NOT for the private key itself. – joovunir Feb 13 '18 at 7:57
  • The password you set at export was for the PFX file and it does contain the private key if you elected to export with that option. – Tara Hodges Feb 14 '18 at 0:57
  • So the question still remains: why would I want to protect the private key of a client certificate? – joovunir Feb 14 '18 at 10:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.