From this question, it is said that when creating a CSR, we attach the public key and fill in other data.

When creating a CSR, you attach your public key to it and fill in other needed data; you then send it to a Certificate Authority (CA). The CA takes the data from your form, and if you pass all their validation tests (i.e. your credit card is charged), they use the data from your CSR to create a certificate, and then they sign your new certificate with their "root" certificate. This gives the rest of the world assurance that the public key found on the certificate is actually associated with you.

So my question is, how are the public key and the "other needed data" (org name, state/city, domain name, etc.) structured to make the CSR? Is it just a simple concatenation, or is there some special encoding?

If there is some special encoding, how does it work? I mean, what mathematical operation or algorithm is done to the public key and the "other needed data" to make the CSR?

  • You are correct that the CSR contains the public key and information associated with the public key, such as the subject name, etc. All of this info is typically packaged using a format called X.509. Then, the entire request is signed using the requestor's private key, to prove that the requestor is in possession of the private key corresponding to the public key in the CSR. This signature is then appended to the X.509 package. See datatracker.ietf.org/doc/html/rfc2511 for more info.
    – mti2935
    Sep 9, 2023 at 15:31
  • 1
    You should read RFC 2986 PKCS #10: Certification Request Syntax Specification Version 1.7 for the details. Sep 9, 2023 at 15:49


You must log in to answer this question.