Everywhere I go, people tell me the private keys need to be kept away, possibly even locked into a safe. Then how come Firefox and other keystores expect you to give them a private key?
Firefox is a client, it shouldn't need this right?


The private key is need by Firefox for client authentication, i.e. when the client demonstrates to the server ownership of a certificate. By definition, this requires knowledge of the private key on the client side. This does not happen often, because most Web servers authenticate clients with passwords, not with certificates.

Of course, Firefox has no need of the private key corresponding to a server certificate, and in practice won't have access to that private key.

Generally speaking, the less a private key travel, the happier we are. However, when it becomes necessary, for some reason, to transport a private key and its accompanying certificate, then we prefer to do it with some extra security to maintain confidentiality; this often uses the PKCS#12 format, also known as "PFX" or ".p12". Such a file is an archive which can contain just about anything, but in particular certificates and private keys, and (that's the point) it includes password-based encryption: parts of the archive contents (e.g. the private key) can be encrypted with a key derived from the password chosen to lock the archive.

| improve this answer | |
  • 1
    ok so the server private key is completely different to the client private key. What about CAs, is my server private key a CA? is every private key a CA? So theoretically I could sign a CSR created from a client private key and go on and run a server from that. – Blub Apr 11 '14 at 13:10
  • 1
    also, do websites never use client authentification or do some banks do that? – Blub Apr 11 '14 at 13:16
  • 1
    If you have a private key you can sign what you want, but if you want to play the role of a CA and issue certificates which are accepted by other people, then these other people must trust your public key in a CA role, which usually means that your public key is in a certificate, signed by another CA (that they trust), and, crucially, that certificate has the "is CA" mark in it (in the Basic Constraints extension, see the RFC). Existing commercial CA won't sell you such a certificate (or only for a wheelbarrow of money bills). – Tom Leek Apr 11 '14 at 13:23
  • 1
    I have seen one bank distributing certificates to its clients, but that's still pretty rare. For a long time, certificate handling by browsers used very ugly popups, which did not help in making client certificates popular. – Tom Leek Apr 11 '14 at 13:24
  • 1
    ok I see, so a CA is just a normal certificate. I was able to drag and drop my certificate into the windows "Trusted Root Certification Authorities\Certificates" store, but it doesnt have an "is CA" mark. – Blub Apr 18 '14 at 10:22

.p12/pfx doesnt neccesarily mean it contains a private key, import it to your keystore to see if you can verify if you have access to the private key.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.