Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive CSR from a client and translate it directly to a self-signed X509 Certificate as if it was the client to self-sign it (it is redudant I know but it is for a project). Basically I want to copy a CSR to a X509 certificate without signing the certificate. I would want to do this for example openssl or golang (for the purpose of this question openssl is enough).

  • Did you try following one of the "how to create a self-signed certificate" guides and see if the commands to create the certificate depend on the key or the csr (and the ca key, that might be another one) as well? You should be able to sign it just using the csr and the CA key.
    – allo
    May 6, 2019 at 11:14
  • I don't want to sign it with the CA's key, I want to convert the CSR to a self-signed certificate (a CSR is pretty much a self sign certificate) May 6, 2019 at 15:14
  • When it should be self-signed, then you need the key. Otherwise it is signed by another key and not self-signed. But maybe signed by an unknown CA (your own) is enough for you? The only other option is to create a new CSR with the same data except for the public key. This certificate then would of course only be useful for people having your private key.
    – allo
    May 7, 2019 at 7:53

2 Answers 2


Self-signed certificate means that the certificate is signed by itself. Since signing is done with the private key you need the private key which matches the public key in the certificate. This means that if you want to keep the public key from the CSR you also need the matching private key.

  • Hello, That makes sense, I just thought that could be a way (maybe an openssl function) that translates a CSR to a .cert (even unsigned maybe) for example. Thank you for your response May 6, 2019 at 15:17
  • @MiguelReis: "...translates a CSR to a .cert (even unsigned maybe)" - A certificate is never unsigned. And specifically a self-signed certificate must obviously be signed as the name implies. May 6, 2019 at 15:46
  • I am aware that self-signed certificate is signed..A certificate has a signature field, an unsigned certificate would have that field empty/null. May 6, 2019 at 17:55
  • Technically, you can put certificate hash in signature field (sha256NoSign calculated over TbsCertificate structure), but this makes zero sense.
    – Crypt32
    May 6, 2019 at 19:14

By definition, a self-signed certificate is the certificate that uses private key associated with the public key in the certificate to sign itself. Public key in the certificate is used to verify the signature of the same certificate. As the result:

convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR?

is impossible.

Let clients to generate their own self-signed certificates on their own. It is another story if you have a CA and can access CA private key to sign CSR and issue the signed certificate, but it is not your case.

Bottom line: when I hear about clients and self-signed certificates, I smell a poor and flawed design. Even for private use, I always recommend to use standard CA software to issue centralized certificates, perform validation, maintain revocation and much more.

  • 1
    Hello, This is just a small part of a process, I know that you should not use self-signed certificates, that is not the point here. A CSR is basically a self-signed certificate that is used to send to a PKI/CA in order to request a certificate, I thought it could be possible to convert it to an actual X509 Certificate self-signed or even unsigned. I guess not Thank you for your response. May 6, 2019 at 15:16
  • A CSR is basically a self-signed certificate -- CSR is only signed public key. Format of CSR (PKCS#10) is way incompatible with X.509 Certificate format. What you are asking makes zero sense, because interaction from your side is not required, client can create a certificate solely on their end.
    – Crypt32
    May 6, 2019 at 19:16
  • "When I hear about clients and self-signed certificates I " completely ignore the stored hash model for verification? Ignore the private CA model?
    – symcbean
    May 6, 2019 at 20:42
  • I didn't say that I ignore private CA model. CA model offers manageability in long-term. Self-signed certificates (if it is not root CA certificate) doesn't.
    – Crypt32
    May 6, 2019 at 20:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .