0

I tried to search online for the difference between both CSR certificate and a certificate but I couldn't find a concrete asnwer. I am doing my own lab using this tutorial https://www.golinuxcloud.com/openssl-create-certificate-chain-linux/.

I noticed for root CA we create a certificate, however for the intermediate CA we create CSR certificate and I can't tell what is the difference. And when reading both files I noticed that they are totally different even though both are certificate (.pem)

To create CA certficate:

openssl req -config openssl_root.cnf -key ~/myCA/rootCA/private/ca.key.pem -new -x509 -days 7300 -sha256 -extensions v3_ca -out ~/myCA/rootCA/certs/ca_cert.pem -subj "/C=US/ST=California/L=San Francisco/O=Example Corp/OU=IT Department/CN=Root CA"

to read CA certificate : openssl x509 -noout -text -in ca_cert.pem

to create CSR certificate:

  openssl req -config openssl_intermediate.cnf -key ~/myCA/intermediateCA/private/intermediate.key.pem -new -sha256 -out ~/myCA/intermediateCA/certs/intermediate.csr.pem -subj "/C=US/ST=California/L=San Francisco/O=Example Corp/OU=IT Department/CN=Intermediate CA"

to read CSR certificate: openssl req -in intermediate_csr.pem -noout -text

Improve this question
3
  • 1
    "create CSR certificate" - there is no CSR certificate - this is not a kind of certificate but a Certificate Signing Request. The is something the issuer CA then uses to create the actual signed certificate.
    – Steffen Ullrich
    Jun 9 at 18:42
  • @SteffenUllrich and which key should be used if I want to create a CSR for a server ? the key of the server or the key of the intermediate CA ?
    – ethicalhacker
    Jun 9 at 19:45
  • The server certificate (and thus the CSR for it) gets its own key, the intermediate CA certificate (and thus the CSR for it) gets its own key etc. No keys are shared.
    – Steffen Ullrich
    Jun 9 at 19:59

1 Answer 1

Reset to default
2

You need to read one step further in the tutorial. The CSR is the Certificate Signing Request, not a certificate. This CSR is then passed to the CA to produce a certificate signed by the CA.

So we're talking about two commands to get the certificate of the intermediate CA, as the tutorial clearly states:

  1. You create a CSR which contains the subject that you would like a certificate for.
  2. The CA takes the CSR and then creates a certificate by copying the subject, adding the necessary extensions and finally signing the certificate.

The reason why the certificate of the root CA only needs one step is that it's self-signed. By definition, there is no CA above it, so generating a CSR wouldn't make any sense. Instead, the root CA certificate is created in a single step.

By the way, the PEM format (which, for historic reasons, stands for Privacy Enhanced Mail) isn't just for certificates. It's used to encode the binary data of keys, CSRs, Certificate Revocation Lists or certificates with Base64. You can clearly see the type of the data by checking the header and footer of the PEM:

-----BEGIN CERTIFICATE REQUEST-----
...
-----END CERTIFICATE REQUEST-----

as opposed to

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .