14

I've created an RSA key. Created a CSR. Got it signed and now I have my certificate. It's for a webserver running https.

The public key can be generated from the private key, so I guess I don't need to keep a separate file with the public key in unless my application needs it (it doesn't).

But can I just delete the CSR now or does it contain anything I might later need?

Improve this question
5
  • Do you mean "public key can be generated from the certificate?" I don't believe you can re-create the pubkey given the privkey; if that was possible the reverse would also be true with catastrophic effects.
    – gowenfawr
    Jun 24, 2013 at 14:22
  • @gowenfawr what? That's the point of a pubkey, it's generated from the privkey. The reverse is not possible.
    – Manishearth
    Jun 24, 2013 at 14:40
  • @gowenfawr can the pubkey come from the certificate? This answer explains what I meant. But anyway, the question remaining is: do I need the CSR?
    – artfulrobot
    Jun 24, 2013 at 14:47
  • I stand corrected (which for me, with math, ain't hard)! Fascinating. And, @artfulrobot, no - you don't need the CSR for anything and can safely delete it.
    – gowenfawr
    Jun 24, 2013 at 14:50
  • 1
    @Gowenfawr - it's worth noting that the private key can only be used to get the public key because the private key stores information that is not strictly speaking part of the private key. The extra data is kept due to performance increases though.
    – AJ Henderson
    Jun 24, 2013 at 15:41

1 Answer 1

Reset to default
14

There's no need to keep either. Of course, you may want to store your public key for convenience (should you ever need to use it directly). For example, I keep my SSH public keys even though I can regenerate them whenever I want -- If I need to copy a specific key to a server, it's more convenient to not have to generate it.

The CSR is also something you can regenerate given the private key. The CSR itself has no power after the certificate is signed. It's OK to release it publicly or to delete it.

Improve this answer
4
  • what about all the details I put in to generate the CSR? common name etc. Can these details be retrieved from the certificate?
    – artfulrobot
    Jun 24, 2013 at 17:50
  • @artfulrobot only partially. I was assuming that these would be remembered by you. Either way, a CSR is useless once you have the cert.
    – Manishearth
    Jun 24, 2013 at 17:55
  • 1
    If you release the CSR publicly couldn't someone use it to recreate the same cert?
    – JasonGabler
    Jan 30, 2019 at 14:55
  • 2
    @JasonGabler Possibly. But they can also just use the copy of the certificate that your HTTPS server sends when they connect. That's how SSL/TLS is supposed to work. But they cannot do anything malicious with the certificate, because the certificate is only valid for your server. By definition, certificates are intended for public distribution, and someone cannot use your certificate to impersonate you (because the certificate is only valid for your server).
    – micheal65536
    Mar 30, 2019 at 22:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .