I am only using digital certificates to sign documents, and my understanding is that the correct flow is the following:
- create a private key (e.g. using openssl)
- create CSR using the previously created private key
- use the CSR to request a digital certificate
- download digital certificate
- create digital identity (pfx file) using the digital certificate (4.) and the private key (1.).
- Use that pfx file to sign pdf, word files, mail, or any other file
The institution that I work for provides the employees different types of digital certificates (from digicert), for multiple purposes, one of which is digital signatures, which is my intended use. On the digicert webpage on which I can generate my own Premium digicert certificate, I only have one field to fill in, which is optional, the CSR field. Some other fields are prefilled, like my name, and the validity (1 year). Not knowing exactly what I'm doing, I first clicked on generate without creating a CSR first. Out of that I got 3 files, the client certificate, and 2 other certificates. They were useless in creating a pfx that can be used to sign documents without a corresponding private key. After a bit of research I learned that I am supposed to follow the steps above, but now I wonder why is the CSR optional. In what circumstances a client certificate without a private key can be used?
The output that I get from digicert when requesting a premium digital certificate seems to be the same, regardless of whether I fill in a CSR or not (3 crt files, one of which is on my name, the other 2 being the 2 companies that trust the client certificate). The only difference is that without a private key, I cannot create a pfx using openssl.
I even tried to create a pfx using the same private key for both sets of premium certificates (created with CSR and without CSR). For the set created with CSR it all worked out ok, and for the set created without filling in a CSR, openssl complained that there is no digital certificate matching the private key.
If my understanding is correct, without a CSR there can't be a link to a private key. Without a public-private key pair, what can one do with a digital certificate?