2

I've only seen private key files (.pfx, .pkcs12) being password protected. Someone told me public cert files (.cer) can also be password-protected. Is that true? Is it also true to say any certificate can be password-protected?

Just a note - I've tried using openssl to create some self-signed certs using the command below, and the only password I was prompted to enter was for the public key. Not sure if that's enough proof that there's no such thing as a public certificate password, or there are additional openssl commands to define public cert password that I don't know about?

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem
Improve this question

1 Answer 1

Reset to default
7

What would be the point ? A public certificate is public: if you need to password-protect it, it would mean your security model is flawed. Therefore, there is no standard way to store an X509 certificate in a password-protected form.

That being said, in practice, you can place a cert into any kind of container: a PGP protected file, a ZIP file, a password-protected PKCS#12 (basically, a PFX) or any type of container.

Improve this answer
6
  • Would you mind expanding a bit more on why the security model would be flawed if the public cert requires password? Does any Certificate Authority even provide certificates that are password protected?
    – Zoomzoom
    Mar 19, 2015 at 14:01
  • CA do not provide anything in password-encrypted form. You give them a certificate request (basically, an unsigned certificate) and they provide you with the signed version. That cert, however, contains the public half of your criptographic key and the private half (which you keep) is usually password protected
    – Stephane
    Mar 19, 2015 at 14:06
  • The whole PKI system is designed to have a public part (which is the public half of your key but also your public certificate) and a private part (the private half of your cryptographic key). If your model requires some information that is public to actually be kept secret, it is a strong indication that you're doing it wrong. Also, it's a contradiction to Kerckhoff's principle.
    – Stephane
    Mar 19, 2015 at 14:13
  • Thank you for the detailed explanation. One more follow-up - I've also been told that people may choose to use a password-protected private key to encrypt as well as decrypt messages. In this case, it's almost as if they're using a password-protected public key. Does this usage even make sense? And it seems to violate Kerckhoff's Principle as well, doesn't it?
    – Zoomzoom
    Mar 19, 2015 at 14:49
  • This is different. The password you place on the private key is a protection measure placed on the part of the data that must remain secure. It's part of what people do to keep the key from being revealed.
    – Stephane
    Mar 19, 2015 at 14:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .