Questions tagged [csr]
A Certificate Signing Request (CSR) is used in a hierarchical PKI to request a new certificate from a Certificate Authority.
68
questions
1
vote
0
answers
24
views
Are ECC CSR always different and if yes, why? [closed]
I've noted that SHA256 of CSRs for RSA keys, generated as
openssl req -new -config leaf.conf -key rsa.key rsa.csr
are always the same, given the same key and configuration. In the same time, every ...
- 181
0
votes
0
answers
85
views
How to include ChangeSubjectName in CSR?
The RFC - 7030 section 4.2.2, EST protocol, suggests to use the Change Subject Name attribute when the client would like to use a different subject for the new issued certificate during reenrollment.
...
- 21
2
votes
0
answers
111
views
How to retrieve TLS unique value from Apache?
TLS unique value is present in TLS 1.2 version.
In Golang, I can get the value of the TLS unique value from the http response through the field TLS.
I'd like know how I can get it from Apache.
Is ...
- 21
0
votes
1
answer
148
views
How to include TLS-unique value in CSR?
I'm using a GlobalSign EST Go library that provides an implementation of the RFC 7030 (EST).
So far doesn't provide any function to generate a CSR at runtime and therefore include the TLS-unique value ...
- 21
-1
votes
2
answers
310
views
What happens to the key pair once the CSR has been enrolled?
I have a key pair which I used to generate a CSR.
Once I enrolled that CSR PKCS10, I get from the PKI (or CA) a certificate signed with the PKI private key.
From here, I would like to know if my ...
- 21
0
votes
0
answers
102
views
Is a Certificate Signing Request a concatenation of public key and metadata?
From this question, it is said that when creating a CSR, we attach the public key and fill in other data.
When creating a CSR, you attach your public key to it and fill in other needed data; you then ...
- 101
0
votes
1
answer
195
views
WebAuthn does not guarantee public-key integrity other than trough attestation?
I've been reading about WebAuthn and try to write some code to exercise.
One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
- 374
1
vote
1
answer
2k
views
How to add additional information to Certificate Signing Request (CSR)?
I would like to generate a Certificate Signing Request (CSR) and add additional custom information in it.
The standard CSR fields are common name, country, organization, organizational unit, etc.
Is ...
- 21
1
vote
1
answer
189
views
Automatic Certificate Signing Request (CSR) Validation
I was wondering if there are papers or well-known algorithms to automate the validation of a Certificate Signing Request (CSR).
Suppose I have a group of trusted services where I expose a "CA ...
- 13
11
votes
3
answers
4k
views
Why create a CSR on my own server to have it signed by a 3rd party?
I am looking into our current website certificate-management process and am looking for steps that may be unnecessary and can be simplified. The current process was created by our sysadmin who now ...
- 375
0
votes
1
answer
105
views
Connection problems with common name as domain
I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
- 1
1
vote
2
answers
1k
views
What is CA response after giving them the CSR?
I'm trying to understand the logical flow of SSL certificate.
Suppose I have a website running on a machine. I generate a CSR file that contains information (e.g. common name, organization, country, .....
- 113
0
votes
2
answers
2k
views
Getting fingerprint of certificate signing request
I am aware that I can get the fingerprint of an x509 certificate by typing
openssl x509 -in certificate.crt -noout -fingerprint
But if I try to get the fingerprint of a CSR (openssl req -in ...
- 151
1
vote
1
answer
2k
views
SSL certificate match with private key but doesn't match with CSR
I use the following command to create your private key and CSR (using the ECC algorithm):
openssl ecparam -out ECC.key -name prime256v1 -genkey -noout
openssl req -new -key ECC.key -out ECC.csr -...
- 37
1
vote
2
answers
409
views
Can any field in a CSR be overwritten in the issued cert?
Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
- 137
0
votes
1
answer
333
views
Certificates generated with a CSR having FQDN different than the URL of web application
I am new to HTTPs and want to have my web application on secure ports. For this, I asked our security department to issue certificates. And I provided them with the CSRs. The CSRs were generated on ...
- 103
0
votes
1
answer
2k
views
Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token
I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
- 284
1
vote
2
answers
4k
views
What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?
While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command:
openssl req -new -addext &...
- 157
0
votes
1
answer
231
views
Sensor device web interface certificate
I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
- 101
1
vote
1
answer
3k
views
openssl csr generation with basicConstraint=CA:False
I would like to know how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False, Please not i do not want to use a ssl configuration file but to ...
- 115
1
vote
0
answers
110
views
When I provision (sign) keys to end-users, can I force the definition of certificate expiration (different from CA expiration)?
Before I proceed to testing this myself I wanted some clarity. I have a basic understanding of SSH and Cryptography but not completely sure about this plan. I want to implement a key rotation policy ...
- 111
1
vote
1
answer
776
views
CSR with no keyUsage or extendedKeyUsage specified and invalid DNS in CommonName - will anyone sign it?
A vendor's software is generating CSRs with no keyUsage or extendedKeyUsage set and in combination with this they contain commonNames that are not fully qualified domain names. If I submit them to ...
- 11
1
vote
1
answer
2k
views
I am unable to use an RSA key generated with the -aes-256-gcm option in openssl, help
When I run:
openssl genrsa -aes-256-gcm -out rootca.key 4096
Then I get the following output:
$ openssl genrsa -aes-256-gcm -out rootca.key 4096
Generating RSA private key, 8192 bit long modulus (2 ...
- 153
1
vote
2
answers
3k
views
Create CSR for S/MIME certificate from existing OpenPGP key pair
While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone).
I believe the ...
- 113
0
votes
1
answer
460
views
who should create a CSR, the developer or system management? [closed]
I am developing an internal web application. I think it would be a good idea to secure the local web server with an https certificate. I read several postings recommending certificates on local ...
- 137
2
votes
1
answer
2k
views
Is certificate signature encoded to ASN.1 format?
I'm working on a diagram to describe the process of issuing digital certificates, with the help of answers on my question here and some other research:
I just read in the IETF that:
The ...
- 157
0
votes
2
answers
414
views
How is CSR encrypted?
Using openssl to generate a CSR:
> openssl req -newkey rsa:2048 -nodes -keyout key -out mycsr.csr
It outputs the mycsr.csr file along with the key file.
The content of mycsr.csr:
-----BEGIN ...
- 157
2
votes
1
answer
1k
views
How is public key included in the CSR?
I've read a lot of articles on the PKI and digital certificate topics because it's very rare to find one article covers all the aspects; also the topic is confusing at the beginning, (this beautiful ...
- 157
0
votes
2
answers
1k
views
Signing CSR using an ECC keypair
I'm trying to sign a CSR using python-asn1crypto and python-pkcs11. I have an ECC Keypair stored in a Hardware Security Module (HSM).
Here's a code sample:
key = decode_ec_public_key(...
- 233
1
vote
1
answer
994
views
Help understanding CSR fields
I've made a CSR (Certificate Signing Request) in order to better understand how a PKI could be made and how it works.
Using the following commands
openssl req -new -newkey rsa:1024 -nodes -out ca.csr ...
- 13
1
vote
1
answer
1k
views
getting no subject alternative name present exception when the csr shows that the SANs are present [duplicate]
I am trying to setup ssl for grpc but no matter what I try I get a no subject alternative name present. I've verified the SANs are in the certificate signing request. The common name and also a SAN ...
- 131
1
vote
1
answer
581
views
Why would a client need our CSR file?
I am a beginner to TLS/Ops.
Our operations team have setup a number of virtual hosts with domains we own for hosting endpoints on our Cloud.
We have 3 virtual hosts-
internal - to be used ...
0
votes
1
answer
1k
views
Generating a CSR for 32 bit private rsa key
I used an OpenSSL 1.0.1k 8 Jan 2015 version to generate a 32-bit RSA key, and I tried to generate a CSR for the key
$ openssl req -new -key privatekey.pem -out csr.pem
139645847348928:error:...
- 3
0
votes
1
answer
295
views
Are all web servers for a domain wildcard certificate supposed to have the same private key?
If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
- 641
0
votes
2
answers
1k
views
CSR signature using elliptic curve
We've been asked to generate certificate signing request using elliptic curve and we can't use any third-party library it's an embedded application with very limited resources).
We are used to ...
1
vote
0
answers
2k
views
openSSL use SAN from CSR [duplicate]
I am trying to create an ssl certificate from a CSR file containing a SAN using openssl, using the command line:
openssl x509 -req -in keyshare.acceptance.privacybydesign.foundation.csr -CA rootCA....
- 11
1
vote
2
answers
2k
views
Convert CSR to self-signed x509 Certificate
Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive ...
- 11
1
vote
1
answer
976
views
What should be OpenSSL .cnf file equivalent of certreq .inf for S/MIME?
Currently I'm using certreq to prepare CSRs for S/MIME certificates. I want to move away from it and start using OpenSSL for key/CSR generation.
My .inf file looks like this:
[Version]
Signature="$...
- 173
1
vote
1
answer
141
views
Code-Signing: Why is the CA process different from web site certificates?
I recently went to renew a code signing certificate. In preparation I went through our usual process (as for web server certificates) of creating a key pair and a CSR with OpenSSL. When I then went ...
- 113
1
vote
1
answer
277
views
Certificate not trusted in Root CA Store - does it still enable secure connection? [duplicate]
I'm a bit new with certificates and have been unable to find an answer on this.
We need to place controls around an application that is accessed via URL, we have moved the URL to citrix, but the ...
- 11
0
votes
1
answer
224
views
CSR verification process by certificate authority
Can some one help me understand the step by step process on CSR signature verification process by Certificate Authority?
Is the contents of the CSR hashed and signed by the server's private key?
Is ...
1
vote
1
answer
6k
views
How to auto renew OpenVPN client certificates using easyRSA
I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
- 111
2
votes
1
answer
3k
views
Multiple CSRs from the same private key
Consider that I generate a new undisclosed private key using openssl:
openssl genrsa -out personal.key 2048
I then generate the multiple CSR requests (called csr1.csr and csr2.csr):
openssl req -...
- 163
2
votes
1
answer
9k
views
How to generate CSR(Certificate Signing Request) using C++ and openssl [closed]
I am new to openssl. I am trying to implement the program to generate CSR using openssl and c++. I need to implement the following commands using C++.
openssl req -new -newkey rsa:1024 -nodes -keyout ...
- 23
1
vote
1
answer
597
views
Remote Private Key for Certificate Authority
Background
I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key ...
- 4,028
3
votes
1
answer
2k
views
Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?
Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
4
votes
1
answer
2k
views
What is the risk of someone intercepting my CSR and private key
In the process of getting a SSL certificate, I generated a CSR and the private key and for some reason had to share them.
What could a malicious person do with those two files ?
0
votes
2
answers
931
views
I need to generate a CSR on my HSM with a critical key usage of Non Repudation?
As above, we were planning to do the following:
Access our HSM (Luna SA)
Generate CSR
Send CSR to 3rd Party CA
Add critical key usage of Non Repudiation on 3rd Parties portal
Send the now signed CSR (...
- 1
10
votes
1
answer
29k
views
CSR expiry date / validity date
If I create a CSR with openssl and set the expiration day to 5 years is it possible that the signing CA will set the expiry date to say one year ? Which one takes precedence ?
EDIT: ok, I think the ...
- 1,588
0
votes
2
answers
2k
views
How and in what context CSR works?
I'm trying to understand scenario under which CSR (certificate signing request) can be useful. Please help me understand the concept and use.
Mutual authentication
In client side authentication, ...
- 1,557