private key of SSL certificate

Question

To create a certificate, first we need to fill a CSR and in CSR we have to place our public key and that key pair can be generated by different ways in different devices. To do ssh, we run command (crypto key generate RSA modules 1024) and generate the key pair.

Now with the help of this command we are generating public and private key for SSH which will help in encryption but the same key can be placed in CSR and from that CSR we can generate a certificate. Is it correct?

Where is the private key stored? I know the private key is very sensitive data but still if I am a server admin of a server or a firewall and want to see the private key then how can we check that? is there is a command for that?

Answer 1

While essentially, SSL and SSH can use the same algorithms and keys, your life will be a lot simpler if you create your CSR with a tool designed for the job (and you should never use re-use keys for different purposes).

On MS Windows you can do this with certreq, or the MMC snap-in for certificates, but I find the tool bundled with IIS easiest to use. For preference I would use openssl with template conf files.

The private key is stored wherever you tell the software to store the private key.

Answer 2

openssl is often used to create keys and CSR's for SSL/TLS certificates. To use openssl to generate a CSR, the process is as follows:

First create the private key. For a 4096 bit RSA key, the command is:

openssl genrsa -out yourdomain.key 4096

To answer your question, 'where is the private key stored?', the file yourdomain.key contains the private key.

Next, create the CSR:

openssl req -new -key yourdomain.key -out yourdomain.csr

This command will ask you a series of questions, including your name, the common name (which is the FQDN of the domain that the certificate will be securing), etc. All of this information, along with the public key derived from the private key in yourdomain.key is contained in the CSR.

Finally, submit the CSR to a CA for them to sign, and they will return the certificate file (most likely in PEM format), containing all of the information in the CSR, signed by the CA.