Questions tagged [csr]

A Certificate Signing Request (CSR) is used in a hierarchical PKI to request a new certificate from a Certificate Authority.

0
votes
0answers
25 views

How to map the “CA issued certificate” to a user in AD?

I'm trying to perform certificate-based WiFi authentication. I've set up the CA and by using the SCEP Challenge Password, I'm able to get the certificate. But I need to map this issued certificate to ...
0
votes
0answers
24 views

CA issued certificates maps to the wrong user in AD

I'm doing certificate-based authentication using windows server 2012. I've set up the CA, NDES and now, when I request a certificate using the SCEP Challenge password, I'm able to receive the ...
2
votes
0answers
66 views

openSSL use SAN from CSR [duplicate]

I am trying to create an ssl certificate from a CSR file containing a SAN using openssl, using the command line: openssl x509 -req -in keyshare.acceptance.privacybydesign.foundation.csr -CA rootCA....
0
votes
2answers
102 views

Convert CSR to self-signed x509 Certificate

Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive ...
1
vote
1answer
52 views

What should be OpenSSL .cnf file equivalent of certreq .inf for S/MIME?

Currently I'm using certreq to prepare CSRs for S/MIME certificates. I want to move away from it and start using OpenSSL for key/CSR generation. My .inf file looks like this: [Version] Signature="$...
1
vote
1answer
53 views

Code-Signing: Why is the CA process different from web site certificates?

I recently went to renew a code signing certificate. In preparation I went through our usual process (as for web server certificates) of creating a key pair and a CSR with OpenSSL. When I then went ...
1
vote
1answer
67 views

Certificate not trusted in Root CA Store - does it still enable secure connection? [duplicate]

I'm a bit new with certificates and have been unable to find an answer on this. We need to place controls around an application that is accessed via URL, we have moved the URL to citrix, but the ...
0
votes
1answer
24 views

CSR verification process by certificate authority

Can some one help me understand the step by step process on CSR signature verification process by Certificate Authority? Is the contents of the CSR hashed and signed by the server's private key? Is ...
1
vote
0answers
440 views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
1
vote
1answer
484 views

Multiple CSRs from the same private key

Consider that I generate a new undisclosed private key using openssl: openssl genrsa -out personal.key 2048 I then generate the multiple CSR requests (called csr1.csr and csr2.csr): openssl req -...
0
votes
1answer
2k views

How to generate CSR(Certificate Signing Request) using C++ and openssl [closed]

I am new to openssl. I am trying to implement the program to generate CSR using openssl and c++. I need to implement the following commands using C++. openssl req -new -newkey rsa:1024 -nodes -keyout ...
1
vote
1answer
235 views

Remote Private Key for Certificate Authority

Background I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key ...
3
votes
1answer
833 views

Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?

Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
3
votes
1answer
316 views

What is the risk of someone intercepting my CSR and private key

In the process of getting a SSL certificate, I generated a CSR and the private key and for some reason had to share them. What could a malicious person do with those two files ?
0
votes
2answers
502 views

I need to generate a CSR on my HSM with a critical key usage of Non Repudation?

As above, we were planning to do the following: Access our HSM (Luna SA) Generate CSR Send CSR to 3rd Party CA Add critical key usage of Non Repudiation on 3rd Parties portal Send the now signed CSR (...
6
votes
1answer
7k views

CSR expiry date / validity date

If I create a CSR with openssl and set the expiration day to 5 years is it possible that the signing CA will set the expiry date to say one year ? Which one takes precedence ? EDIT: ok, I think the ...
0
votes
2answers
461 views

How and in what context CSR works?

I'm trying to understand scenario under which CSR (certificate signing request) can be useful. Please help me understand the concept and use. Mutual authentication In client side authentication, ...
0
votes
3answers
140 views

Signing API requests with a private key: Does this key delivery scenario sound secure?

I am a software developer but a newbie when it comes to online security. Company A has some desktop software used by customers C and D (C unrelated to D). Company B has a web service and has the same ...
1
vote
2answers
653 views

CA signature algorithm vs certificate public key algorithm

Is there any restriction on the CAs signature algorithm with respect to the public algorithm in the actual server/device certificate? For example, can a ECDHE_ECDSA_* certificate be signed by a CA ...
0
votes
1answer
1k views

Which OpenSSL commands update the CA database index file?

Have I understood correctly that when CSR is signed with openssl x509 tool, a CA database index file is not updating ? As opposite, when signing with openssl ca tool, then index file is updating.
1
vote
2answers
1k views

Why is generating Certificate Signing Request (CSR) supposed to be platform/machine specific?

I've seen questions Is it true that certificates requested with a specific CSR can only be used on the machine where the CSR was generated? and CSR generation origin? and Generate CSR code on local ...
0
votes
1answer
325 views

Is the CSR and public key the exact same thing?

Is the CSR and public key the exact same thing? I require the CSR - can I create a Public key from .cer and use it as CSR? I need the CSR for HPKP backup key generation. Is OpenSSL the only way to ...
1
vote
0answers
49 views

CSR and private key generated twice but still prone to drown attack

we generated the CSR and private key Installed SSL cert and was Graded F as our server was prone to DROWN attack. Somehow the private key was the same as another key of an existing server that has ...
0
votes
1answer
32 views

What threats and mitigations are there for a CA when processing a CSR?

Question What kinds of technical nastiness/attacks should I look for in a Certificate Request (CSR) ? Assume the ASN1 parser is secure on the CA. I'm strictly concerned with the process of ...
0
votes
1answer
448 views

How can a CSR be generated by OpenSSL without the public key

Ok, so the general steps to make a Certificate Signing Request are (as I understand it) as follows: Generate a key pair Put my identifying information and the public key (or its hash) into a document ...
3
votes
1answer
427 views

Why does the CSR contains an explicit curve when generating private key with genpkey?

When I generated the SSL key using ecparam, I got a CSR with a named curve: $ openssl ecparam -genkey -out ecparam.key -name prime256v1 $ openssl req -new -sha256 -key ecparam.key -out ecparam.csr -...
2
votes
1answer
149 views

Invalid CSR when using Let's Encrypt web tools

I've created a CSR using IIS. When I paste the text here... https://www.sslshopper.com/csr-decoder.html ... it validates correctly. But when I use the Let's Encrypt tools here... https://zerossl....
2
votes
0answers
41 views

CSR Generation for Root and Subdomain FQDNs [duplicate]

I need to secure services operating under my root domain (e.g. example.com) and one or more services operating under subdomains of that root domain (e.g. api.example.com, mail.example.com, etc). I can ...
2
votes
1answer
31 views

Checking the certificate sent back by the CA

If a client sends a CSR to the CA and gets back a certificate signed by the CA, then is it standard practice for the client to verify if the certificate is indeed signed by the CA or can the client ...
0
votes
2answers
900 views

SSL certificate for server authentication

to clear my understandings: I create self signed certificate first keytool -genkey -alias mysign -keyalg RSA -keystore mykeystorename.jks the firstname of the self sign has to be my domain name? ...
0
votes
1answer
268 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
2
votes
1answer
710 views

How is PKCS#10 and x509 related?

I'm unable to make sense of them using the RFCs. Can anyone help? When I use this function, http://www.pyopenssl.org/en/stable/api/crypto.html#x509req-objects , am I creating a PKCS#10 format CSR?
-1
votes
1answer
331 views

Generate CSR code on local machine

I've tried activating an SSL cert. When it asked for the CSR code, I was thinking about generating this code on local machine because I haven't rented my own VPS yet. The thing is, I'm not sure ...
1
vote
1answer
262 views

Have a CSR signed twice

For a customer we need to order a SSL certificate, normally this would be done by their help-desk and we provide the CSR. But as the old certificate will expire soon, and their help-desk need about 7 ...
3
votes
1answer
1k views

Why does SubjectAltName not turn up in my CSR?

Does the CSR generated contains the SubjectAltName I have configured the openssl.cnf file to support extensions and when i dump the CSR i can see subject is available not the SubjectAltName This is ...