0

If remember right, then before I send a CSR (Certificate signing request) to the CA, I have to create private and public keys.

Then I use the public key to encrypt my personal details before I send them to the CA as a CSR file.

Why do I need the private key for?

And how does the CA read my CSR if only I have my private key?

Improve this question
6
  • 2
    A simple wikipedia search may answer this: en.wikipedia.org/wiki/Certificate_signing_request and en.wikipedia.org/wiki/Public_key_infrastructure
    – binaryanomaly
    Commented May 5, 2014 at 19:40
  • I don't think these links answer my questions directly... also, I've read them before I posted my question.
    – rapt
    Commented May 5, 2014 at 19:55
  • 2
    @rapt It might help if we knew that you understood the basics of asymmetric encryption. Do you? Do you know the functional difference between encrypting something with either your public or private keys and how to decrypt in either scenario?
    – schroeder ♦
    Commented May 5, 2014 at 20:17
  • I think I do understand the basics: asymmetric encryption/decryption: encryption is done by a public key, decryption by a private key; each side has their own pair of public/private keys. Symmetric encryption/decryption: both encryption and decryption are done by a single secret key that is known only to both sides.
    – rapt
    Commented May 5, 2014 at 20:36
  • You answered your own question, it seems.
    – Joshua Nurczyk
    Commented May 5, 2014 at 21:22

1 Answer 1

Reset to default
3

From the wikipedia link:

Before creating a CSR, the applicant first generates a key pair, keeping the private key secret. The CSR contains information identifying the applicant (such as a distinguished name in the case of an X.509 certificate) which must be signed using the applicant's private key.

Add:

The CSR contains the public key + additional information. It is signed (not encrpyted!) with the private key to proof authenticity (hint: can be verified with the public key).

Proofing that you own the domain or are the person that this certificate is issued for is a different, separate process. Domain validation is easyily verified by sending an email to the admin of the domain. Enhanced Validation (EV) the green bar, takes some physical proof and is a more extensive process therefore more expensive. Dito for certs issued to a person.

Improve this answer
3
  • I still have a hard time to understand why this requirement appears. So the CA that is asked to create a certificate can now know that the CSR was signed by the person who has the private key that matches the public key that was attached to the CSR. But how does it prove that the applicant is the person whose details appear on the CSR? Also, if the CSR is encrypted by the applicant's public key (?), then how would the CA decrypt it?
    – rapt
    Commented May 5, 2014 at 21:51
  • @rapt Consider the point above about signing. It's one reason to encrypt with a public key.
    – schroeder ♦
    Commented May 5, 2014 at 22:57
  • One problem solved, thank you - you clarified my mistake: now I understand the CSR is not encrypted. Okay so in the CSR I fill out my roommate's details, create the key pair, and use the private key to sign the CSR. How would that authenticate me to the CA? The CA only knows now that the applicant truly has the private key, but not that the actual applicant is not lying about their identity. That's what I don't understand. How the fact that I showed the CA that I own the private key helps the CA authenticate me (which means, I assume, prove that the applicant is the person they claim they are)
    – rapt
    Commented May 5, 2014 at 23:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .