Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [csr]

A Certificate Signing Request (CSR) is used in a hierarchical PKI to request a new certificate from a Certificate Authority.

Filter by
Sorted by
Tagged with
0 votes
0 answers
44 views

How to include ChangeSubjectName in CSR?

The RFC - 7030 section 4.2.2, EST protocol, suggests to use the Change Subject Name attribute when the client would like to use a different subject for the new issued certificate during reenrollment. ...
MoBe's user avatar
  • 21
2 votes
0 answers
89 views

How to retrieve TLS unique value from Apache?

TLS unique value is present in TLS 1.2 version. In Golang, I can get the value of the TLS unique value from the http response through the field TLS. I'd like know how I can get it from Apache. Is ...
MoBe's user avatar
  • 21
0 votes
1 answer
123 views

How to include TLS-unique value in CSR?

I'm using a GlobalSign EST Go library that provides an implementation of the RFC 7030 (EST). So far doesn't provide any function to generate a CSR at runtime and therefore include the TLS-unique value ...
MoBe's user avatar
  • 21
-1 votes
2 answers
245 views

What happens to the key pair once the CSR has been enrolled?

I have a key pair which I used to generate a CSR. Once I enrolled that CSR PKCS10, I get from the PKI (or CA) a certificate signed with the PKI private key. From here, I would like to know if my ...
MoBe's user avatar
  • 21
0 votes
0 answers
92 views

Is a Certificate Signing Request a concatenation of public key and metadata?

From this question, it is said that when creating a CSR, we attach the public key and fill in other data. When creating a CSR, you attach your public key to it and fill in other needed data; you then ...
JLC's user avatar
  • 101
0 votes
1 answer
155 views

WebAuthn does not guarantee public-key integrity other than trough attestation?

I've been reading about WebAuthn and try to write some code to exercise. One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
DannyNiu's user avatar
  • 374
1 vote
1 answer
1k views

How to add additional information to Certificate Signing Request (CSR)?

I would like to generate a Certificate Signing Request (CSR) and add additional custom information in it. The standard CSR fields are common name, country, organization, organizational unit, etc. Is ...
Equinox's user avatar
  • 21
1 vote
1 answer
163 views

Automatic Certificate Signing Request (CSR) Validation

I was wondering if there are papers or well-known algorithms to automate the validation of a Certificate Signing Request (CSR). Suppose I have a group of trusted services where I expose a "CA ...
Fidelio's user avatar
  • 13
11 votes
3 answers
4k views

Why create a CSR on my own server to have it signed by a 3rd party?

I am looking into our current website certificate-management process and am looking for steps that may be unnecessary and can be simplified. The current process was created by our sysadmin who now ...
user2713516's user avatar
0 votes
1 answer
99 views

Connection problems with common name as domain

I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
SandMan's user avatar
1 vote
2 answers
877 views

What is CA response after giving them the CSR?

I'm trying to understand the logical flow of SSL certificate. Suppose I have a website running on a machine. I generate a CSR file that contains information (e.g. common name, organization, country, .....
Mostafa's user avatar
  • 113
0 votes
2 answers
1k views

Getting fingerprint of certificate signing request

I am aware that I can get the fingerprint of an x509 certificate by typing openssl x509 -in certificate.crt -noout -fingerprint But if I try to get the fingerprint of a CSR (openssl req -in ...
JoSSte's user avatar
  • 149
1 vote
1 answer
1k views

SSL certificate match with private key but doesn't match with CSR

I use the following command to create your private key and CSR (using the ECC algorithm): openssl ecparam -out ECC.key -name prime256v1 -genkey -noout openssl req -new -key ECC.key -out ECC.csr -...
Tần Quảng's user avatar
0 votes
2 answers
350 views

Can any field in a CSR be overwritten in the issued cert?

Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
Liam Kelly's user avatar
0 votes
1 answer
300 views

Certificates generated with a CSR having FQDN different than the URL of web application

I am new to HTTPs and want to have my web application on secure ports. For this, I asked our security department to issue certificates. And I provided them with the CSRs. The CSRs were generated on ...
74H1R's user avatar
  • 103
0 votes
1 answer
1k views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
Bharat Vasant's user avatar
1 vote
2 answers
3k views

What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?

While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command: openssl req -new -addext &...
Chris Bornhoft's user avatar
0 votes
1 answer
224 views

Sensor device web interface certificate

I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
Tomas Creemers's user avatar
1 vote
1 answer
2k views

openssl csr generation with basicConstraint=CA:False

I would like to know how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False, Please not i do not want to use a ssl configuration file but to ...
choppe's user avatar
  • 115
1 vote
0 answers
106 views

When I provision (sign) keys to end-users, can I force the definition of certificate expiration (different from CA expiration)?

Before I proceed to testing this myself I wanted some clarity. I have a basic understanding of SSH and Cryptography but not completely sure about this plan. I want to implement a key rotation policy ...
bitoiu's user avatar
  • 111
1 vote
1 answer
621 views

CSR with no keyUsage or extendedKeyUsage specified and invalid DNS in CommonName - will anyone sign it?

A vendor's software is generating CSRs with no keyUsage or extendedKeyUsage set and in combination with this they contain commonNames that are not fully qualified domain names. If I submit them to ...
Chagrin's user avatar
  • 11
1 vote
1 answer
2k views

I am unable to use an RSA key generated with the -aes-256-gcm option in openssl, help

When I run: openssl genrsa -aes-256-gcm -out rootca.key 4096 Then I get the following output: $ openssl genrsa -aes-256-gcm -out rootca.key 4096 Generating RSA private key, 8192 bit long modulus (2 ...
Example person's user avatar
1 vote
2 answers
2k views

Create CSR for S/MIME certificate from existing OpenPGP key pair

While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone). I believe the ...
Yoda's user avatar
  • 113
0 votes
1 answer
393 views

who should create a CSR, the developer or system management? [closed]

I am developing an internal web application. I think it would be a good idea to secure the local web server with an https certificate. I read several postings recommending certificates on local ...
Roland's user avatar
  • 137
2 votes
1 answer
2k views

Is certificate signature encoded to ASN.1 format?

I'm working on a diagram to describe the process of issuing digital certificates, with the help of answers on my question here and some other research: I just read in the IETF that: The ...
mshwf's user avatar
  • 157
0 votes
2 answers
383 views

How is CSR encrypted?

Using openssl to generate a CSR: > openssl req -newkey rsa:2048 -nodes -keyout key -out mycsr.csr It outputs the mycsr.csr file along with the key file. The content of mycsr.csr: -----BEGIN ...
mshwf's user avatar
  • 157
2 votes
1 answer
1k views

How is public key included in the CSR?

I've read a lot of articles on the PKI and digital certificate topics because it's very rare to find one article covers all the aspects; also the topic is confusing at the beginning, (this beautiful ...
mshwf's user avatar
  • 157
0 votes
2 answers
1k views

Signing CSR using an ECC keypair

I'm trying to sign a CSR using python-asn1crypto and python-pkcs11. I have an ECC Keypair stored in a Hardware Security Module (HSM). Here's a code sample: key = decode_ec_public_key(...
No name's user avatar
  • 223
1 vote
1 answer
917 views

Help understanding CSR fields

I've made a CSR (Certificate Signing Request) in order to better understand how a PKI could be made and how it works. Using the following commands openssl req -new -newkey rsa:1024 -nodes -out ca.csr ...
Vilos's user avatar
  • 13
1 vote
1 answer
945 views

getting no subject alternative name present exception when the csr shows that the SANs are present [duplicate]

I am trying to setup ssl for grpc but no matter what I try I get a no subject alternative name present. I've verified the SANs are in the certificate signing request. The common name and also a SAN ...
Jeff Gaer's user avatar
  • 131
0 votes
1 answer
543 views

Why would a client need our CSR file?

I am a beginner to TLS/Ops. Our operations team have setup a number of virtual hosts with domains we own for hosting endpoints on our Cloud. We have 3 virtual hosts- internal - to be used ...
Farhan stands with Palestine's user avatar
0 votes
1 answer
1k views

Generating a CSR for 32 bit private rsa key

I used an OpenSSL 1.0.1k 8 Jan 2015 version to generate a 32-bit RSA key, and I tried to generate a CSR for the key $ openssl req -new -key privatekey.pem -out csr.pem 139645847348928:error:...
Pwny's user avatar
  • 3
0 votes
1 answer
283 views

Are all web servers for a domain wildcard certificate supposed to have the same private key?

If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
johnny's user avatar
  • 641
0 votes
2 answers
1k views

CSR signature using elliptic curve

We've been asked to generate certificate signing request using elliptic curve and we can't use any third-party library it's an embedded application with very limited resources). We are used to ...
Laurent PerrucheJ's user avatar
1 vote
0 answers
2k views

openSSL use SAN from CSR [duplicate]

I am trying to create an ssl certificate from a CSR file containing a SAN using openssl, using the command line: openssl x509 -req -in keyshare.acceptance.privacybydesign.foundation.csr -CA rootCA....
davidv1992's user avatar
1 vote
2 answers
2k views

Convert CSR to self-signed x509 Certificate

Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive ...
Miguel Reis's user avatar
1 vote
1 answer
915 views

What should be OpenSSL .cnf file equivalent of certreq .inf for S/MIME?

Currently I'm using certreq to prepare CSRs for S/MIME certificates. I want to move away from it and start using OpenSSL for key/CSR generation. My .inf file looks like this: [Version] Signature="$...
StanTastic's user avatar
1 vote
1 answer
135 views

Code-Signing: Why is the CA process different from web site certificates?

I recently went to renew a code signing certificate. In preparation I went through our usual process (as for web server certificates) of creating a key pair and a CSR with OpenSSL. When I then went ...
Daniel Schneller's user avatar
1 vote
1 answer
260 views

Certificate not trusted in Root CA Store - does it still enable secure connection? [duplicate]

I'm a bit new with certificates and have been unable to find an answer on this. We need to place controls around an application that is accessed via URL, we have moved the URL to citrix, but the ...
mks5251's user avatar
  • 11
0 votes
1 answer
209 views

CSR verification process by certificate authority

Can some one help me understand the step by step process on CSR signature verification process by Certificate Authority? Is the contents of the CSR hashed and signed by the server's private key? Is ...
Vignesh Ramanan's user avatar
1 vote
1 answer
6k views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
Ahmad Karim's user avatar
1 vote
1 answer
3k views

Multiple CSRs from the same private key

Consider that I generate a new undisclosed private key using openssl: openssl genrsa -out personal.key 2048 I then generate the multiple CSR requests (called csr1.csr and csr2.csr): openssl req -...
David Refoua's user avatar
2 votes
1 answer
8k views

How to generate CSR(Certificate Signing Request) using C++ and openssl [closed]

I am new to openssl. I am trying to implement the program to generate CSR using openssl and c++. I need to implement the following commands using C++. openssl req -new -newkey rsa:1024 -nodes -keyout ...
Kumar's user avatar
  • 23
1 vote
1 answer
572 views

Remote Private Key for Certificate Authority

Background I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key ...
nbering's user avatar
  • 4,028
3 votes
1 answer
2k views

Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?

Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
Omer Levi Hevroni's user avatar
4 votes
1 answer
1k views

What is the risk of someone intercepting my CSR and private key

In the process of getting a SSL certificate, I generated a CSR and the private key and for some reason had to share them. What could a malicious person do with those two files ?
thesearentthedroids's user avatar
0 votes
2 answers
920 views

I need to generate a CSR on my HSM with a critical key usage of Non Repudation?

As above, we were planning to do the following: Access our HSM (Luna SA) Generate CSR Send CSR to 3rd Party CA Add critical key usage of Non Repudiation on 3rd Parties portal Send the now signed CSR (...
Steve's user avatar
  • 1
10 votes
1 answer
27k views

CSR expiry date / validity date

If I create a CSR with openssl and set the expiration day to 5 years is it possible that the signing CA will set the expiry date to say one year ? Which one takes precedence ? EDIT: ok, I think the ...
cyzczy's user avatar
  • 1,588
0 votes
2 answers
2k views

How and in what context CSR works?

I'm trying to understand scenario under which CSR (certificate signing request) can be useful. Please help me understand the concept and use. Mutual authentication In client side authentication, ...
Saladin's user avatar
  • 1,557
0 votes
3 answers
478 views

Signing API requests with a private key: Does this key delivery scenario sound secure?

I am a software developer but a newbie when it comes to online security. Company A has some desktop software used by customers C and D (C unrelated to D). Company B has a web service and has the same ...
Simon Hewitt's user avatar