I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases.

We'd like to implement Microsoft Active Directory Certificate Services (AD CS) to issue certificates for internal applications and websites, and this is where the confusion lies. Prior to this, whether it was IIS or Apache/Tomcat, we would generate CSRs through OpenSSL using a private key and passphrase.

Now that I'm researching AD CS, it appears that, for IIS, the CSR is created on the IIS server, and then processed through the CA server, generating the .cer/.crt and private key. We can extract the private key and store it in the event something happens.

But what about the passphrase? Does IIS not require a private key to have one? Is there a way to generate a CSR/private key in IIS using a private key passphrase? Can we still use OpenSSL to generate a .csr and process it through AD CS?


  • 1
    Why do you want to store/backup the private key? If something happens to the server, just generate a new private key, and generate a new cert. Keeping an extra copy just doubles the attack surface. – Daisetsu Oct 11 '18 at 22:02
  • PKI doesn't require a passphrase, that's usually optional as a way to protect the private key, but in this case IIS directly creates a request which the AD CS accepts, and signs creating a certificate which IIS in turn installs. The real benefit is that now systems on your domain will trust that certificate and not show warnings. – Daisetsu Oct 11 '18 at 22:08
  • 1
    Indeed the only way to make use of a passphrase as such would be to export the private key, at which point you can specify a passphrase/password. But as @Daisetsu pointed out, consider whether the benefit of this outweighs the risk and vice versa. – gb5757870 Oct 11 '18 at 22:10
  • 1
    To be more explicit: IIS causes its Windows cryptoprovider to generate the privatekey within the Windows "cert" store (as a special pending-no-cert-yet entry) and the CSR; the CSR is sent to ADCS which creates and returns the certificate, which is joined to the key already in the IIS-machine's certstore. That certstore key is protected by Windows. If you export the cert-and-key from the certstore to PFX/PKCS12 at that point it is encrypted (and MACed) with a passphrase. – dave_thompson_085 Oct 12 '18 at 4:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.