I use these commands to create a self-signed certificate, subject's key and CSR, and subject's signed certificate:

Root CA:
openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -nodes

Server CSR:
openssl req -new -sha256 -out server.csr -keyout server.key.pem  -nodes

Sign with CA:
openssl ca -cert ca.crt -days 3650 -md sha256 -in server.csr -out server.crt

The CA signs the CSR with its private key, does this mean that the root certificate (ca.crt) contains the private key?

1 Answer 1


The private key is never included in the certificate, certificates are publicly available.

The CA key is specified either through a flag or through the config file. When none is specified, the default config file is used (depends on how openssl was built) which points to $dir/private/cakey.pem for the private key (at least mine does, mileage may vary).

To properly use openssl you should really have a config file specifying the desired values. See this StackOverflow question for a lot more details. Or if you don't want to deal with the madness and giant pile of cruft that is openssl, use a more modern tool such as cfssl.

  • I specified the -key flag but still using the config file and complaining about "No such file or directory" for the key path in the config file
    – mshwf
    Aug 31, 2020 at 9:52
  • I recommend walking exactly through some posted examples, then tweaking the configs/invocation one you get the hang of it. openssl is notoriously prickly.
    – Marc
    Aug 31, 2020 at 9:54
  • It's -keyfile not -key
    – mshwf
    Aug 31, 2020 at 9:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .