Questions tagged [csr]

A Certificate Signing Request (CSR) is used in a hierarchical PKI to request a new certificate from a Certificate Authority.

Filter by
Sorted by
Tagged with
0 votes
1 answer
32 views

Connection problems with common name as domain

I was exploring SAN certs and was able to connect to the machine with domains specified in the SAN fields during CSR creation. But I was unable to connect to the machine with the common name specified ...
0 votes
2 answers
66 views

What is CA response after giving them the CSR?

I'm trying to understand the logical flow of SSL certificate. Suppose I have a website running on a machine. I generate a CSR file that contains information (e.g. common name, organization, country, .....
  • 103
0 votes
1 answer
78 views

Getting fingerprint of certificate signing request

I am aware that I can get the fingerprint of an x509 certificate by typing openssl x509 -in certificate.crt -noout -fingerprint But if I try to get the fingerprint of a CSR (openssl req -in ...
  • 123
1 vote
1 answer
125 views

SSL certificate match with private key but doesn't match with CSR

I use the following command to create your private key and CSR (using the ECC algorithm): openssl ecparam -out ECC.key -name prime256v1 -genkey -noout openssl req -new -key ECC.key -out ECC.csr -...
0 votes
2 answers
70 views

Can any field in a CSR be overwritten in the issued cert?

Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not ...
0 votes
1 answer
59 views

Certificates generated with a CSR having FQDN different than the URL of web application

I am new to HTTPs and want to have my web application on secure ports. For this, I asked our security department to issue certificates. And I provided them with the CSRs. The CSRs were generated on ...
  • 103
0 votes
1 answer
287 views

Web Browser Certificate Enrollment (CSR Generation) and Certificate Download to Smartcard or USB Token

I am developing Web Application for Certifying Authority as a part of which, I need to generate asymmetric key pair - Private Key and Public Key in user's smartcard through browser, create Certificate ...
0 votes
2 answers
699 views

What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?

While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command: openssl req -new -addext &...
0 votes
1 answer
146 views

Sensor device web interface certificate

I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
0 votes
1 answer
576 views

openssl csr generation with basicConstraint=CA:False

I would like to know how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False, Please not i do not want to use a ssl configuration file but to ...
  • 103
1 vote
0 answers
76 views

When I provision (sign) keys to end-users, can I force the definition of certificate expiration (different from CA expiration)?

Before I proceed to testing this myself I wanted some clarity. I have a basic understanding of SSH and Cryptography but not completely sure about this plan. I want to implement a key rotation policy ...
  • 111
1 vote
1 answer
165 views

CSR with no keyUsage or extendedKeyUsage specified and invalid DNS in CommonName - will anyone sign it?

A vendor's software is generating CSRs with no keyUsage or extendedKeyUsage set and in combination with this they contain commonNames that are not fully qualified domain names. If I submit them to ...
  • 11
1 vote
1 answer
1k views

I am unable to use an RSA key generated with the -aes-256-gcm option in openssl, help

When I run: openssl genrsa -aes-256-gcm -out rootca.key 4096 Then I get the following output: $ openssl genrsa -aes-256-gcm -out rootca.key 4096 Generating RSA private key, 8192 bit long modulus (2 ...
1 vote
2 answers
1k views

Create CSR for S/MIME certificate from existing OpenPGP key pair

While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone). I believe the ...
  • 113
0 votes
1 answer
162 views

who should create a CSR, the developer or system management? [closed]

I am developing an internal web application. I think it would be a good idea to secure the local web server with an https certificate. I read several postings recommending certificates on local ...
  • 137
1 vote
1 answer
1k views

Is certificate signature encoded to ASN.1 format?

I'm working on a diagram to describe the process of issuing digital certificates, with the help of answers on my question here and some other research: I just read in the IETF that: The ...
  • 147
0 votes
2 answers
214 views

How is CSR encrypted?

Using openssl to generate a CSR: > openssl req -newkey rsa:2048 -nodes -keyout key -out mycsr.csr It outputs the mycsr.csr file along with the key file. The content of mycsr.csr: -----BEGIN ...
  • 147
2 votes
1 answer
594 views

How is public key included in the CSR?

I've read a lot of articles on the PKI and digital certificate topics because it's very rare to find one article covers all the aspects; also the topic is confusing at the beginning, (this beautiful ...
  • 147
0 votes
2 answers
499 views

Signing CSR using an ECC keypair

I'm trying to sign a CSR using python-asn1crypto and python-pkcs11. I have an ECC Keypair stored in a Hardware Security Module (HSM). Here's a code sample: key = decode_ec_public_key(...
  • 93
1 vote
1 answer
477 views

Help understanding CSR fields

I've made a CSR (Certificate Signing Request) in order to better understand how a PKI could be made and how it works. Using the following commands openssl req -new -newkey rsa:1024 -nodes -out ca.csr ...
  • 13
1 vote
1 answer
411 views

getting no subject alternative name present exception when the csr shows that the SANs are present [duplicate]

I am trying to setup ssl for grpc but no matter what I try I get a no subject alternative name present. I've verified the SANs are in the certificate signing request. The common name and also a SAN ...
  • 131
0 votes
1 answer
228 views

Why would a client need our CSR file?

I am a beginner to TLS/Ops. Our operations team have setup a number of virtual hosts with domains we own for hosting endpoints on our Cloud. We have 3 virtual hosts- internal - to be used ...
0 votes
1 answer
910 views

Generating a CSR for 32 bit private rsa key

I used an OpenSSL 1.0.1k 8 Jan 2015 version to generate a 32-bit RSA key, and I tried to generate a CSR for the key $ openssl req -new -key privatekey.pem -out csr.pem 139645847348928:error:...
  • 3
0 votes
1 answer
210 views

Are all web servers for a domain wildcard certificate supposed to have the same private key?

If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
  • 641
0 votes
2 answers
569 views

CSR signature using elliptic curve

We've been asked to generate certificate signing request using elliptic curve and we can't use any third-party library it's an embedded application with very limited resources). We are used to ...
1 vote
0 answers
1k views

openSSL use SAN from CSR [duplicate]

I am trying to create an ssl certificate from a CSR file containing a SAN using openssl, using the command line: openssl x509 -req -in keyshare.acceptance.privacybydesign.foundation.csr -CA rootCA....
0 votes
2 answers
1k views

Convert CSR to self-signed x509 Certificate

Is it possible to receive a certificate request (CSR) and convert it to a self-signed X509 Certificate without having access to the private key that signed the CSR? I want to do the following: receive ...
1 vote
1 answer
552 views

What should be OpenSSL .cnf file equivalent of certreq .inf for S/MIME?

Currently I'm using certreq to prepare CSRs for S/MIME certificates. I want to move away from it and start using OpenSSL for key/CSR generation. My .inf file looks like this: [Version] Signature="$...
1 vote
1 answer
100 views

Code-Signing: Why is the CA process different from web site certificates?

I recently went to renew a code signing certificate. In preparation I went through our usual process (as for web server certificates) of creating a key pair and a CSR with OpenSSL. When I then went ...
1 vote
1 answer
165 views

Certificate not trusted in Root CA Store - does it still enable secure connection? [duplicate]

I'm a bit new with certificates and have been unable to find an answer on this. We need to place controls around an application that is accessed via URL, we have moved the URL to citrix, but the ...
  • 11
0 votes
1 answer
125 views

CSR verification process by certificate authority

Can some one help me understand the step by step process on CSR signature verification process by Certificate Authority? Is the contents of the CSR hashed and signed by the server's private key? Is ...
1 vote
1 answer
4k views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
1 vote
1 answer
2k views

Multiple CSRs from the same private key

Consider that I generate a new undisclosed private key using openssl: openssl genrsa -out personal.key 2048 I then generate the multiple CSR requests (called csr1.csr and csr2.csr): openssl req -...
2 votes
1 answer
7k views

How to generate CSR(Certificate Signing Request) using C++ and openssl [closed]

I am new to openssl. I am trying to implement the program to generate CSR using openssl and c++. I need to implement the following commands using C++. openssl req -new -newkey rsa:1024 -nodes -keyout ...
  • 23
1 vote
1 answer
469 views

Remote Private Key for Certificate Authority

Background I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key ...
  • 3,988
3 votes
1 answer
1k views

Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?

Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
4 votes
1 answer
936 views

What is the risk of someone intercepting my CSR and private key

In the process of getting a SSL certificate, I generated a CSR and the private key and for some reason had to share them. What could a malicious person do with those two files ?
0 votes
2 answers
729 views

I need to generate a CSR on my HSM with a critical key usage of Non Repudation?

As above, we were planning to do the following: Access our HSM (Luna SA) Generate CSR Send CSR to 3rd Party CA Add critical key usage of Non Repudiation on 3rd Parties portal Send the now signed CSR (...
  • 1
9 votes
1 answer
20k views

CSR expiry date / validity date

If I create a CSR with openssl and set the expiration day to 5 years is it possible that the signing CA will set the expiry date to say one year ? Which one takes precedence ? EDIT: ok, I think the ...
  • 1,518
0 votes
2 answers
1k views

How and in what context CSR works?

I'm trying to understand scenario under which CSR (certificate signing request) can be useful. Please help me understand the concept and use. Mutual authentication In client side authentication, ...
  • 1,547
0 votes
3 answers
255 views

Signing API requests with a private key: Does this key delivery scenario sound secure?

I am a software developer but a newbie when it comes to online security. Company A has some desktop software used by customers C and D (C unrelated to D). Company B has a web service and has the same ...
1 vote
2 answers
1k views

CA signature algorithm vs certificate public key algorithm

Is there any restriction on the CAs signature algorithm with respect to the public algorithm in the actual server/device certificate? For example, can a ECDHE_ECDSA_* certificate be signed by a CA ...
  • 15
0 votes
1 answer
4k views

Which OpenSSL commands update the CA database index file?

Have I understood correctly that when CSR is signed with openssl x509 tool, a CA database index file is not updating ? As opposite, when signing with openssl ca tool, then index file is updating.
3 votes
2 answers
3k views

Why is generating Certificate Signing Request (CSR) supposed to be platform/machine specific?

I've seen questions Is it true that certificates requested with a specific CSR can only be used on the machine where the CSR was generated? and CSR generation origin? and Generate CSR code on local ...
  • 33
1 vote
1 answer
2k views

Is the CSR and public key the exact same thing?

Is the CSR and public key the exact same thing? I require the CSR - can I create a Public key from .cer and use it as CSR? I need the CSR for HPKP backup key generation. Is OpenSSL the only way to ...
1 vote
0 answers
82 views

CSR and private key generated twice but still prone to drown attack

we generated the CSR and private key Installed SSL cert and was Graded F as our server was prone to DROWN attack. Somehow the private key was the same as another key of an existing server that has ...
  • 11
0 votes
1 answer
69 views

What threats and mitigations are there for a CA when processing a CSR?

Question What kinds of technical nastiness/attacks should I look for in a Certificate Request (CSR) ? Assume the ASN1 parser is secure on the CA. I'm strictly concerned with the process of ...
0 votes
1 answer
1k views

How can a CSR be generated by OpenSSL without the public key

Ok, so the general steps to make a Certificate Signing Request are (as I understand it) as follows: Generate a key pair Put my identifying information and the public key (or its hash) into a document ...
3 votes
1 answer
888 views

Why does the CSR contains an explicit curve when generating private key with genpkey?

When I generated the SSL key using ecparam, I got a CSR with a named curve: $ openssl ecparam -genkey -out ecparam.key -name prime256v1 $ openssl req -new -sha256 -key ecparam.key -out ecparam.csr -...
  • 31.1k
2 votes
1 answer
222 views

Invalid CSR when using Let's Encrypt web tools

I've created a CSR using IIS. When I paste the text here... https://www.sslshopper.com/csr-decoder.html ... it validates correctly. But when I use the Let's Encrypt tools here... https://zerossl....