Questions tagged [csr]

A Certificate Signing Request (CSR) is used in a hierarchical PKI to request a new certificate from a Certificate Authority.

Filter by
Sorted by
Tagged with
0
votes
1answer
67 views

Generating a CSR for 32 bit private rsa key

I used an OpenSSL 1.0.1k 8 Jan 2015 version to generate a 32-bit RSA key, and I tried to generate a CSR for the key $ openssl req -new -key privatekey.pem -out csr.pem 139645847348928:error:...
0
votes
1answer
60 views

Are all web servers for a domain wildcard certificate supposed to have the same private key?

If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
0
votes
2answers
132 views

CSR signature using elliptic curve

We've been asked to generate certificate signing request using elliptic curve and we can't use any third-party library it's an embedded application with very limited resources). We are used to ...
0
votes
0answers
30 views

How to map the “CA issued certificate” to a user in AD?

I'm trying to perform certificate-based WiFi authentication. I've set up the CA and by using the SCEP Challenge Password, I'm able to get the certificate. But I need to map this issued certificate to ...
0
votes
0answers
33 views

CA issued certificates maps to the wrong user in AD

I'm doing certificate-based authentication using windows server 2012. I've set up the CA, NDES and now, when I request a certificate using the SCEP Challenge password, I'm able to receive the ...
2
votes
0answers
277 views

openSSL use SAN from CSR [duplicate]

I am trying to create an ssl certificate from a CSR file containing a SAN using openssl, using the command line: openssl x509 -req -in keyshare.acceptance.privacybydesign.foundation.csr -CA rootCA....
0
votes
2answers
421 views

Convert CSR to self-signed x509 Certificate

Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive ...
1
vote
1answer
117 views

What should be OpenSSL .cnf file equivalent of certreq .inf for S/MIME?

Currently I'm using certreq to prepare CSRs for S/MIME certificates. I want to move away from it and start using OpenSSL for key/CSR generation. My .inf file looks like this: [Version] Signature="$...
1
vote
1answer
56 views

Code-Signing: Why is the CA process different from web site certificates?

I recently went to renew a code signing certificate. In preparation I went through our usual process (as for web server certificates) of creating a key pair and a CSR with OpenSSL. When I then went ...
1
vote
1answer
84 views

Certificate not trusted in Root CA Store - does it still enable secure connection? [duplicate]

I'm a bit new with certificates and have been unable to find an answer on this. We need to place controls around an application that is accessed via URL, we have moved the URL to citrix, but the ...
0
votes
1answer
37 views

CSR verification process by certificate authority

Can some one help me understand the step by step process on CSR signature verification process by Certificate Authority? Is the contents of the CSR hashed and signed by the server's private key? Is ...
1
vote
1answer
878 views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
1
vote
1answer
829 views

Multiple CSRs from the same private key

Consider that I generate a new undisclosed private key using openssl: openssl genrsa -out personal.key 2048 I then generate the multiple CSR requests (called csr1.csr and csr2.csr): openssl req -...
1
vote
1answer
3k views

How to generate CSR(Certificate Signing Request) using C++ and openssl [closed]

I am new to openssl. I am trying to implement the program to generate CSR using openssl and c++. I need to implement the following commands using C++. openssl req -new -newkey rsa:1024 -nodes -keyout ...
1
vote
1answer
318 views

Remote Private Key for Certificate Authority

Background I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key ...
3
votes
1answer
1k views

Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?

Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
3
votes
1answer
439 views

What is the risk of someone intercepting my CSR and private key

In the process of getting a SSL certificate, I generated a CSR and the private key and for some reason had to share them. What could a malicious person do with those two files ?
0
votes
2answers
569 views

I need to generate a CSR on my HSM with a critical key usage of Non Repudation?

As above, we were planning to do the following: Access our HSM (Luna SA) Generate CSR Send CSR to 3rd Party CA Add critical key usage of Non Repudiation on 3rd Parties portal Send the now signed CSR (...
6
votes
1answer
10k views

CSR expiry date / validity date

If I create a CSR with openssl and set the expiration day to 5 years is it possible that the signing CA will set the expiry date to say one year ? Which one takes precedence ? EDIT: ok, I think the ...
0
votes
2answers
677 views

How and in what context CSR works?

I'm trying to understand scenario under which CSR (certificate signing request) can be useful. Please help me understand the concept and use. Mutual authentication In client side authentication, ...
0
votes
3answers
165 views

Signing API requests with a private key: Does this key delivery scenario sound secure?

I am a software developer but a newbie when it comes to online security. Company A has some desktop software used by customers C and D (C unrelated to D). Company B has a web service and has the same ...
1
vote
2answers
796 views

CA signature algorithm vs certificate public key algorithm

Is there any restriction on the CAs signature algorithm with respect to the public algorithm in the actual server/device certificate? For example, can a ECDHE_ECDSA_* certificate be signed by a CA ...
0
votes
1answer
2k views

Which OpenSSL commands update the CA database index file?

Have I understood correctly that when CSR is signed with openssl x509 tool, a CA database index file is not updating ? As opposite, when signing with openssl ca tool, then index file is updating.
2
votes
2answers
2k views

Why is generating Certificate Signing Request (CSR) supposed to be platform/machine specific?

I've seen questions Is it true that certificates requested with a specific CSR can only be used on the machine where the CSR was generated? and CSR generation origin? and Generate CSR code on local ...
0
votes
1answer
511 views

Is the CSR and public key the exact same thing?

Is the CSR and public key the exact same thing? I require the CSR - can I create a Public key from .cer and use it as CSR? I need the CSR for HPKP backup key generation. Is OpenSSL the only way to ...
1
vote
0answers
49 views

CSR and private key generated twice but still prone to drown attack

we generated the CSR and private key Installed SSL cert and was Graded F as our server was prone to DROWN attack. Somehow the private key was the same as another key of an existing server that has ...
0
votes
1answer
34 views

What threats and mitigations are there for a CA when processing a CSR?

Question What kinds of technical nastiness/attacks should I look for in a Certificate Request (CSR) ? Assume the ASN1 parser is secure on the CA. I'm strictly concerned with the process of ...
0
votes
1answer
509 views

How can a CSR be generated by OpenSSL without the public key

Ok, so the general steps to make a Certificate Signing Request are (as I understand it) as follows: Generate a key pair Put my identifying information and the public key (or its hash) into a document ...
3
votes
1answer
542 views

Why does the CSR contains an explicit curve when generating private key with genpkey?

When I generated the SSL key using ecparam, I got a CSR with a named curve: $ openssl ecparam -genkey -out ecparam.key -name prime256v1 $ openssl req -new -sha256 -key ecparam.key -out ecparam.csr -...
2
votes
1answer
175 views

Invalid CSR when using Let's Encrypt web tools

I've created a CSR using IIS. When I paste the text here... https://www.sslshopper.com/csr-decoder.html ... it validates correctly. But when I use the Let's Encrypt tools here... https://zerossl....
2
votes
0answers
54 views

CSR Generation for Root and Subdomain FQDNs [duplicate]

I need to secure services operating under my root domain (e.g. example.com) and one or more services operating under subdomains of that root domain (e.g. api.example.com, mail.example.com, etc). I can ...
2
votes
1answer
31 views

Checking the certificate sent back by the CA

If a client sends a CSR to the CA and gets back a certificate signed by the CA, then is it standard practice for the client to verify if the certificate is indeed signed by the CA or can the client ...
0
votes
2answers
1k views

SSL certificate for server authentication

to clear my understandings: I create self signed certificate first keytool -genkey -alias mysign -keyalg RSA -keystore mykeystorename.jks the firstname of the self sign has to be my domain name? ...
0
votes
1answer
310 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
2
votes
1answer
845 views

How is PKCS#10 and x509 related?

I'm unable to make sense of them using the RFCs. Can anyone help? When I use this function, http://www.pyopenssl.org/en/stable/api/crypto.html#x509req-objects , am I creating a PKCS#10 format CSR?
-1
votes
1answer
374 views

Generate CSR code on local machine

I've tried activating an SSL cert. When it asked for the CSR code, I was thinking about generating this code on local machine because I haven't rented my own VPS yet. The thing is, I'm not sure ...
1
vote
1answer
321 views

Have a CSR signed twice

For a customer we need to order a SSL certificate, normally this would be done by their help-desk and we provide the CSR. But as the old certificate will expire soon, and their help-desk need about 7 ...
3
votes
1answer
2k views

Why does SubjectAltName not turn up in my CSR?

Does the CSR generated contains the SubjectAltName I have configured the openssl.cnf file to support extensions and when i dump the CSR i can see subject is available not the SubjectAltName This is ...