Is it possible to issue a certificate with different attributes than in certificate siging request? I have a keypair and I generated a cert. request with extra attributes. Can the CA/RA or anybody modify the request wo my keypair when it is signed?


The certificate request is just a container to transport your public key and some information you like to have included in the certificate. The only thing the CA really needs from this is your public key. Everything else can be ignored by the CA and will often be ignored and instead the CA will create a new certificate request which includes your public key and the information the CA likes to include into the certificate. This new certificate request then gets signed, i.e. usually not your original certificate request.

  • 4
    The CSR also proves possession of the privatekey, for what little that's worth. And what the CA signs is a cert-info, not a CSR; they are NOT the same. But yes what the CA puts in the cert is the CA's decision and often different from what the CSR asked for. In fact if the CSR requests things you are not authorized for, like basicConstraints:true or keyUsage:certSign, the CA must not include them in the cert. – dave_thompson_085 Sep 3 '15 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.