1

I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate:

Root CA:
openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -nodes

Server CSR:
openssl req -new -sha256 -out server.csr -keyout server.key.pem  -nodes

Sign with CA:
openssl ca -cert ca.crt -days 3650 -md sha256 -in server.csr -out server.crt

The CA signs the CSR with its private key, does this mean that the root certificate (ca.crt) contains the private key?

Improve this question

2 Answers 2

Reset to default
4

The private key is never included in the certificate, certificates are publicly available.

The CA key is specified either through a flag or through the config file. When none is specified, the default config file is used (depends on how openssl was built) which points to $dir/private/cakey.pem for the private key (at least mine does, mileage may vary).

To properly use openssl you should really have a config file specifying the desired values. See this StackOverflow question for a lot more details. Or if you don't want to deal with the madness and giant pile of cruft that is openssl, use a more modern tool such as cfssl.

Improve this answer
3
  • I specified the -key flag but still using the config file and complaining about "No such file or directory" for the key path in the config file
    – mshwf
    Aug 31, 2020 at 9:52
  • I recommend walking exactly through some posted examples, then tweaking the configs/invocation one you get the hang of it. openssl is notoriously prickly.
    – Marc
    Aug 31, 2020 at 9:54
  • It's -keyfile not -key
    – mshwf
    Aug 31, 2020 at 9:56
-1

The Idea of a certificate Is like your passport.

A trusted organization (Government) vouches to any or all recipients of the passport that Mr Smith has passportID XYZ.

So a certificate will always bind a human readable name of a person or an entity to a public key that everyone can see.

The private key is NEVER EVER sent out to anyone and the moment it does, the certificates issued from it should NOT be trusted.

Improve this answer
1
  • 1
    How is the passport analogy helpful in understanding not releasing the private key? You make no connection there.
    – schroeder ♦
    Sep 27, 2020 at 16:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .