Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive CSR from a client and translate it directly to a self-signed X509 Certificate as if it was the client to self-sign it (it is redudant I know but it is for a project). Basically I want to copy a CSR to a X509 certificate without signing the certificate. I would want to do this for example openssl or golang (for the purpose of this question openssl is enough).

  • Did you try following one of the "how to create a self-signed certificate" guides and see if the commands to create the certificate depend on the key or the csr (and the ca key, that might be another one) as well? You should be able to sign it just using the csr and the CA key. – allo May 6 '19 at 11:14
  • I don't want to sign it with the CA's key, I want to convert the CSR to a self-signed certificate (a CSR is pretty much a self sign certificate) – Miguel Reis May 6 '19 at 15:14
  • When it should be self-signed, then you need the key. Otherwise it is signed by another key and not self-signed. But maybe signed by an unknown CA (your own) is enough for you? The only other option is to create a new CSR with the same data except for the public key. This certificate then would of course only be useful for people having your private key. – allo May 7 '19 at 7:53

Self-signed certificate means that the certificate is signed by itself. Since signing is done with the private key you need the private key which matches the public key in the certificate. This means that if you want to keep the public key from the CSR you also need the matching private key.

| improve this answer | |
  • Hello, That makes sense, I just thought that could be a way (maybe an openssl function) that translates a CSR to a .cert (even unsigned maybe) for example. Thank you for your response – Miguel Reis May 6 '19 at 15:17
  • @MiguelReis: "...translates a CSR to a .cert (even unsigned maybe)" - A certificate is never unsigned. And specifically a self-signed certificate must obviously be signed as the name implies. – Steffen Ullrich May 6 '19 at 15:46
  • I am aware that self-signed certificate is signed..A certificate has a signature field, an unsigned certificate would have that field empty/null. – Miguel Reis May 6 '19 at 17:55
  • Technically, you can put certificate hash in signature field (sha256NoSign calculated over TbsCertificate structure), but this makes zero sense. – Crypt32 May 6 '19 at 19:14

By definition, a self-signed certificate is the certificate that uses private key associated with the public key in the certificate to sign itself. Public key in the certificate is used to verify the signature of the same certificate. As the result:

convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR?

is impossible.

Let clients to generate their own self-signed certificates on their own. It is another story if you have a CA and can access CA private key to sign CSR and issue the signed certificate, but it is not your case.

Bottom line: when I hear about clients and self-signed certificates, I smell a poor and flawed design. Even for private use, I always recommend to use standard CA software to issue centralized certificates, perform validation, maintain revocation and much more.

| improve this answer | |
  • Hello, This is just a small part of a process, I know that you should not use self-signed certificates, that is not the point here. A CSR is basically a self-signed certificate that is used to send to a PKI/CA in order to request a certificate, I thought it could be possible to convert it to an actual X509 Certificate self-signed or even unsigned. I guess not Thank you for your response. – Miguel Reis May 6 '19 at 15:16
  • A CSR is basically a self-signed certificate -- CSR is only signed public key. Format of CSR (PKCS#10) is way incompatible with X.509 Certificate format. What you are asking makes zero sense, because interaction from your side is not required, client can create a certificate solely on their end. – Crypt32 May 6 '19 at 19:16
  • "When I hear about clients and self-signed certificates I " completely ignore the stored hash model for verification? Ignore the private CA model? – symcbean May 6 '19 at 20:42
  • I didn't say that I ignore private CA model. CA model offers manageability in long-term. Self-signed certificates (if it is not root CA certificate) doesn't. – Crypt32 May 6 '19 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.