Questions tagged [csr]
A Certificate Signing Request (CSR) is used in a hierarchical PKI to request a new certificate from a Certificate Authority.
64
questions
0
votes
0
answers
37
views
Is a Certificate Signing Request a concatenation of public key and metadata?
From this question, it is said that when creating a CSR, we attach the public key and fill in other data.
When creating a CSR, you attach your public key to it and fill in other needed data; you then ...
- 1
0
votes
1
answer
53
views
WebAuthn does not guarantee public-key integrity other than trough attestation?
I've been reading about WebAuthn and try to write some code to exercise.
One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
- 360
0
votes
1
answer
217
views
How to add additional information to Certificate Signing Request (CSR)?
I would like to generate a Certificate Signing Request (CSR) and add additional custom information in it.
The standard CSR fields are common name, country, organization, organizational unit, etc.
Is ...
- 11
1
vote
1
answer
90
views
Automatic Certificate Signing Request (CSR) Validation
I was wondering if there are papers or well-known algorithms to automate the validation of a Certificate Signing Request (CSR).
Suppose I have a group of trusted services where I expose a "CA ...
- 13
11
votes
3
answers
4k
views
Why create a CSR on my own server to have it signed by a 3rd party?
I am looking into our current website certificate-management process and am looking for steps that may be unnecessary and can be simplified. The current process was created by our sysadmin who now ...
- 375
0
votes
0
answers
42
views
Add null byte to hostname using OpenSSL [duplicate]
I am trying to create a certificate signing request (CSR), whose CN contains a null byte. It should look something like this: CN = bad.com\0.good.com. I am using OpenSSL to create the request, but the ...
- 13
0
votes
1
answer
62
views
Connection problems with common name as domain
I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
- 1
0
votes
2
answers
419
views
What is CA response after giving them the CSR?
I'm trying to understand the logical flow of SSL certificate.
Suppose I have a website running on a machine. I generate a CSR file that contains information (e.g. common name, organization, country, .....
- 103
0
votes
2
answers
524
views
Getting fingerprint of certificate signing request
I am aware that I can get the fingerprint of an x509 certificate by typing
openssl x509 -in certificate.crt -noout -fingerprint
But if I try to get the fingerprint of a CSR (openssl req -in ...
- 149
1
vote
1
answer
991
views
SSL certificate match with private key but doesn't match with CSR
I use the following command to create your private key and CSR (using the ECC algorithm):
openssl ecparam -out ECC.key -name prime256v1 -genkey -noout
openssl req -new -key ECC.key -out ECC.csr -...
- 37
0
votes
2
answers
216
views
Can any field in a CSR be overwritten in the issued cert?
Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
- 127
0
votes
1
answer
154
views
Certificates generated with a CSR having FQDN different than the URL of web application
I am new to HTTPs and want to have my web application on secure ports. For this, I asked our security department to issue certificates. And I provided them with the CSRs. The CSRs were generated on ...
- 103
0
votes
1
answer
747
views
Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token
I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
- 284
1
vote
2
answers
2k
views
What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?
While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command:
openssl req -new -addext &...
- 155
0
votes
1
answer
174
views
Sensor device web interface certificate
I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
- 101
1
vote
1
answer
2k
views
openssl csr generation with basicConstraint=CA:False
I would like to know how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False, Please not i do not want to use a ssl configuration file but to ...
- 113
1
vote
0
answers
82
views
When I provision (sign) keys to end-users, can I force the definition of certificate expiration (different from CA expiration)?
Before I proceed to testing this myself I wanted some clarity. I have a basic understanding of SSH and Cryptography but not completely sure about this plan. I want to implement a key rotation policy ...
- 111
1
vote
1
answer
313
views
CSR with no keyUsage or extendedKeyUsage specified and invalid DNS in CommonName - will anyone sign it?
A vendor's software is generating CSRs with no keyUsage or extendedKeyUsage set and in combination with this they contain commonNames that are not fully qualified domain names. If I submit them to ...
- 11
1
vote
1
answer
2k
views
I am unable to use an RSA key generated with the -aes-256-gcm option in openssl, help
When I run:
openssl genrsa -aes-256-gcm -out rootca.key 4096
Then I get the following output:
$ openssl genrsa -aes-256-gcm -out rootca.key 4096
Generating RSA private key, 8192 bit long modulus (2 ...
- 153
1
vote
2
answers
2k
views
Create CSR for S/MIME certificate from existing OpenPGP key pair
While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone).
I believe the ...
- 113
0
votes
1
answer
239
views
who should create a CSR, the developer or system management? [closed]
I am developing an internal web application. I think it would be a good idea to secure the local web server with an https certificate. I read several postings recommending certificates on local ...
- 137
2
votes
1
answer
2k
views
Is certificate signature encoded to ASN.1 format?
I'm working on a diagram to describe the process of issuing digital certificates, with the help of answers on my question here and some other research:
I just read in the IETF that:
The ...
- 157
0
votes
2
answers
287
views
How is CSR encrypted?
Using openssl to generate a CSR:
> openssl req -newkey rsa:2048 -nodes -keyout key -out mycsr.csr
It outputs the mycsr.csr file along with the key file.
The content of mycsr.csr:
-----BEGIN ...
- 157
2
votes
1
answer
921
views
How is public key included in the CSR?
I've read a lot of articles on the PKI and digital certificate topics because it's very rare to find one article covers all the aspects; also the topic is confusing at the beginning, (this beautiful ...
- 157
0
votes
2
answers
861
views
Signing CSR using an ECC keypair
I'm trying to sign a CSR using python-asn1crypto and python-pkcs11. I have an ECC Keypair stored in a Hardware Security Module (HSM).
Here's a code sample:
key = decode_ec_public_key(...
- 193
1
vote
1
answer
708
views
Help understanding CSR fields
I've made a CSR (Certificate Signing Request) in order to better understand how a PKI could be made and how it works.
Using the following commands
openssl req -new -newkey rsa:1024 -nodes -out ca.csr ...
- 13
1
vote
1
answer
721
views
getting no subject alternative name present exception when the csr shows that the SANs are present [duplicate]
I am trying to setup ssl for grpc but no matter what I try I get a no subject alternative name present. I've verified the SANs are in the certificate signing request. The common name and also a SAN ...
- 131
0
votes
1
answer
379
views
Why would a client need our CSR file?
I am a beginner to TLS/Ops.
Our operations team have setup a number of virtual hosts with domains we own for hosting endpoints on our Cloud.
We have 3 virtual hosts-
internal - to be used ...
0
votes
1
answer
1k
views
Generating a CSR for 32 bit private rsa key
I used an OpenSSL 1.0.1k 8 Jan 2015 version to generate a 32-bit RSA key, and I tried to generate a CSR for the key
$ openssl req -new -key privatekey.pem -out csr.pem
139645847348928:error:...
- 3
0
votes
1
answer
242
views
Are all web servers for a domain wildcard certificate supposed to have the same private key?
If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
- 641
0
votes
2
answers
850
views
CSR signature using elliptic curve
We've been asked to generate certificate signing request using elliptic curve and we can't use any third-party library it's an embedded application with very limited resources).
We are used to ...
1
vote
0
answers
2k
views
openSSL use SAN from CSR [duplicate]
I am trying to create an ssl certificate from a CSR file containing a SAN using openssl, using the command line:
openssl x509 -req -in keyshare.acceptance.privacybydesign.foundation.csr -CA rootCA....
- 11
1
vote
2
answers
2k
views
Convert CSR to self-signed x509 Certificate
Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive ...
- 11
1
vote
1
answer
737
views
What should be OpenSSL .cnf file equivalent of certreq .inf for S/MIME?
Currently I'm using certreq to prepare CSRs for S/MIME certificates. I want to move away from it and start using OpenSSL for key/CSR generation.
My .inf file looks like this:
[Version]
Signature="$...
- 173
1
vote
1
answer
107
views
Code-Signing: Why is the CA process different from web site certificates?
I recently went to renew a code signing certificate. In preparation I went through our usual process (as for web server certificates) of creating a key pair and a CSR with OpenSSL. When I then went ...
- 113
1
vote
1
answer
202
views
Certificate not trusted in Root CA Store - does it still enable secure connection? [duplicate]
I'm a bit new with certificates and have been unable to find an answer on this.
We need to place controls around an application that is accessed via URL, we have moved the URL to citrix, but the ...
- 11
0
votes
1
answer
157
views
CSR verification process by certificate authority
Can some one help me understand the step by step process on CSR signature verification process by Certificate Authority?
Is the contents of the CSR hashed and signed by the server's private key?
Is ...
1
vote
1
answer
5k
views
How to auto renew OpenVPN client certificates using easyRSA
I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
- 111
1
vote
1
answer
2k
views
Multiple CSRs from the same private key
Consider that I generate a new undisclosed private key using openssl:
openssl genrsa -out personal.key 2048
I then generate the multiple CSR requests (called csr1.csr and csr2.csr):
openssl req -...
- 153
2
votes
1
answer
8k
views
How to generate CSR(Certificate Signing Request) using C++ and openssl [closed]
I am new to openssl. I am trying to implement the program to generate CSR using openssl and c++. I need to implement the following commands using C++.
openssl req -new -newkey rsa:1024 -nodes -keyout ...
- 23
1
vote
1
answer
509
views
Remote Private Key for Certificate Authority
Background
I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key ...
- 4,008
3
votes
1
answer
2k
views
Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?
Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
4
votes
1
answer
1k
views
What is the risk of someone intercepting my CSR and private key
In the process of getting a SSL certificate, I generated a CSR and the private key and for some reason had to share them.
What could a malicious person do with those two files ?
0
votes
2
answers
853
views
I need to generate a CSR on my HSM with a critical key usage of Non Repudation?
As above, we were planning to do the following:
Access our HSM (Luna SA)
Generate CSR
Send CSR to 3rd Party CA
Add critical key usage of Non Repudiation on 3rd Parties portal
Send the now signed CSR (...
- 1
9
votes
1
answer
24k
views
CSR expiry date / validity date
If I create a CSR with openssl and set the expiration day to 5 years is it possible that the signing CA will set the expiry date to say one year ? Which one takes precedence ?
EDIT: ok, I think the ...
- 1,558
0
votes
2
answers
1k
views
How and in what context CSR works?
I'm trying to understand scenario under which CSR (certificate signing request) can be useful. Please help me understand the concept and use.
Mutual authentication
In client side authentication, ...
- 1,557
0
votes
3
answers
413
views
Signing API requests with a private key: Does this key delivery scenario sound secure?
I am a software developer but a newbie when it comes to online security.
Company A has some desktop software used by customers C and D (C unrelated to D).
Company B has a web service and has the same ...
- 109
1
vote
2
answers
2k
views
CA signature algorithm vs certificate public key algorithm
Is there any restriction on the CAs signature algorithm with respect to the public algorithm in the actual server/device certificate? For example, can a ECDHE_ECDSA_* certificate be signed by a CA ...
- 15
0
votes
1
answer
4k
views
Which OpenSSL commands update the CA database index file?
Have I understood correctly that when CSR is signed with openssl x509 tool, a CA database index file is not updating ? As opposite, when signing with openssl ca tool, then index file is updating.
- 43
3
votes
2
answers
3k
views
Why is generating Certificate Signing Request (CSR) supposed to be platform/machine specific?
I've seen questions Is it true that certificates requested with a specific CSR can only be used on the machine where the CSR was generated? and CSR generation origin? and Generate CSR code on local ...
- 33