I am only using digital certificates to sign documents, and my understanding is that the correct flow is the following:

  1. create a private key (e.g. using openssl)
  2. create CSR using the previously created private key
  3. use the CSR to request a digital certificate
  4. download digital certificate
  5. create digital identity (pfx file) using the digital certificate (4.) and the private key (1.).
  6. Use that pfx file to sign pdf, word files, mail, or any other file

The institution that I work for provides the employees different types of digital certificates (from digicert), for multiple purposes, one of which is digital signatures, which is my intended use. On the digicert webpage on which I can generate my own Premium digicert certificate, I only have one field to fill in, which is optional, the CSR field. Some other fields are prefilled, like my name, and the validity (1 year). Not knowing exactly what I'm doing, I first clicked on generate without creating a CSR first. Out of that I got 3 files, the client certificate, and 2 other certificates. They were useless in creating a pfx that can be used to sign documents without a corresponding private key. After a bit of research I learned that I am supposed to follow the steps above, but now I wonder why is the CSR optional. In what circumstances a client certificate without a private key can be used?

The output that I get from digicert when requesting a premium digital certificate seems to be the same, regardless of whether I fill in a CSR or not (3 crt files, one of which is on my name, the other 2 being the 2 companies that trust the client certificate). The only difference is that without a private key, I cannot create a pfx using openssl.

I even tried to create a pfx using the same private key for both sets of premium certificates (created with CSR and without CSR). For the set created with CSR it all worked out ok, and for the set created without filling in a CSR, openssl complained that there is no digital certificate matching the private key.

If my understanding is correct, without a CSR there can't be a link to a private key. Without a public-private key pair, what can one do with a digital certificate?


If my understanding is correct, without a CSR there can't be a link to a private key

Your understanding is wrong.
The CSR contains the public key and is signed by the private key. The private key is kept private by the owner of the certificate (which is not the CA). It is not given to the CA inside the CSR. The CA also does not need the private key but only the public key since the public key is ending up in the final certificate.

  • well, I was onto something that my understanding is wrong, but it's not much better now unfortunately. Ok, I get it that the private key stays private, but I still don't know what one can do with a digital certificate that was created without a CSR, so without a public key coresponding to a private key. – Andrei Apr 8 at 12:47
  • 1
    @Andrei: your description of "I noticed that the CSR field is optional when requesting a certificate." is for a specific application or website or whatever you use. It is not clear what this application or site is and what it will do when you don't enter a CSR. Please provide the missing context since otherwise it is impossible to help you. – Steffen Ullrich Apr 8 at 13:04

The certificate provider is giving you the option to either:

A. Generate your own key pair and CSR, and send the CSR to them for signing; or

B. Allow them to generate the key pair and CSR for you, they sign it, and you download the bundle from them containing both the certificate and private key.

The choice is yours: if you trust them to have a copy of your private key, option B is a good convenience factor that can make your certificate management easier. If you don’t/can’t/shouldn’t trust them, then your only option is to generate your own keys and provide them with the CSR to sign.

No matter what, you must have the private key in your possession in order to sign documents.

  • That's also what I thought, but there is no private key in the bundle. It's the same 3 crt files I get, regardless of whether I used a CSR or not. More specifically the digicert root certificate, the terena certificate for the chain of trust, and the personal certificate with my name. There's no private key to be found anywhere. If it's generated I don't get it. Is there anything one can do without a private key? – Andrei Apr 8 at 17:00
  • Make sure that when you download the certificate you download it in a keystore format, such as PKCS#12 or JKS, and be sure to select the option to include the private key. – John Deters Apr 8 at 18:03
  • There are no such options. There is exactly 1 download button, and there are no checks around it or dropdown menus to select the format. When I click that download button I get 3 crt files, and that's it. Are you saying that there has to be an option to get the private key, otherwise the 3 certificates are useless? – Andrei Apr 8 at 18:15
  • If you didn’t provide a CSR, and they aren’t letting you download a private key they generated, the certificates are worthless. – John Deters Apr 8 at 18:38
  • Perhaps your account wasn’t set up properly? Contact your CA and get to the bottom of this. – John Deters Apr 8 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.