Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [csr]

A Certificate Signing Request (CSR) is used in a hierarchical PKI to request a new certificate from a Certificate Authority.

1
vote
1answer
35 views

What should be OpenSSL .cnf file equivalent of certreq .inf for S/MIME?

Currently I'm using certreq to prepare CSRs for S/MIME certificates. I want to move away from it and start using OpenSSL for key/CSR generation. My .inf file looks like this: [Version] Signature="$...
1
vote
1answer
52 views

Code-Signing: Why is the CA process different from web site certificates?

I recently went to renew a code signing certificate. In preparation I went through our usual process (as for web server certificates) of creating a key pair and a CSR with OpenSSL. When I then went ...
1
vote
1answer
64 views

Certificate not trusted in Root CA Store - does it still enable secure connection? [duplicate]

I'm a bit new with certificates and have been unable to find an answer on this. We need to place controls around an application that is accessed via URL, we have moved the URL to citrix, but the ...
0
votes
1answer
20 views

CSR verification process by certificate authority

Can some one help me understand the step by step process on CSR signature verification process by Certificate Authority? Is the contents of the CSR hashed and signed by the server's private key? Is ...
1
vote
0answers
352 views

How to auto renew OpenVPN client certificates using easyRSA

I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. ...
1
vote
1answer
345 views

Multiple CSRs from the same private key

Consider that I generate a new undisclosed private key using openssl: openssl genrsa -out personal.key 2048 I then generate the multiple CSR requests (called csr1.csr and csr2.csr): openssl req -...
0
votes
1answer
2k views

How to generate CSR(Certificate Signing Request) using C++ and openssl [closed]

I am new to openssl. I am trying to implement the program to generate CSR using openssl and c++. I need to implement the following commands using C++. openssl req -new -newkey rsa:1024 -nodes -keyout ...
1
vote
1answer
175 views

Remote Private Key for Certificate Authority

Background I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key ...
3
votes
1answer
731 views

Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?

Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
3
votes
1answer
266 views

What is the risk of someone intercepting my CSR and private key

In the process of getting a SSL certificate, I generated a CSR and the private key and for some reason had to share them. What could a malicious person do with those two files ?
0
votes
2answers
477 views

I need to generate a CSR on my HSM with a critical key usage of Non Repudation?

As above, we were planning to do the following: Access our HSM (Luna SA) Generate CSR Send CSR to 3rd Party CA Add critical key usage of Non Repudiation on 3rd Parties portal Send the now signed CSR (...
5
votes
1answer
7k views

CSR expiry date / validity date

If I create a CSR with openssl and set the expiration day to 5 years is it possible that the signing CA will set the expiry date to say one year ? Which one takes precedence ? EDIT: ok, I think the ...
0
votes
2answers
396 views

How and in what context CSR works?

I'm trying to understand scenario under which CSR (certificate signing request) can be useful. Please help me understand the concept and use. Mutual authentication In client side authentication, ...
0
votes
3answers
133 views

Signing API requests with a private key: Does this key delivery scenario sound secure?

I am a software developer but a newbie when it comes to online security. Company A has some desktop software used by customers C and D (C unrelated to D). Company B has a web service and has the same ...
1
vote
2answers
609 views

CA signature algorithm vs certificate public key algorithm

Is there any restriction on the CAs signature algorithm with respect to the public algorithm in the actual server/device certificate? For example, can a ECDHE_ECDSA_* certificate be signed by a CA ...
0
votes
1answer
1k views

Which OpenSSL commands update the CA database index file?

Have I understood correctly that when CSR is signed with openssl x509 tool, a CA database index file is not updating ? As opposite, when signing with openssl ca tool, then index file is updating.
1
vote
2answers
952 views

Why is generating Certificate Signing Request (CSR) supposed to be platform/machine specific?

I've seen questions Is it true that certificates requested with a specific CSR can only be used on the machine where the CSR was generated? and CSR generation origin? and Generate CSR code on local ...
0
votes
1answer
265 views

Is the CSR and public key the exact same thing?

Is the CSR and public key the exact same thing? I require the CSR - can I create a Public key from .cer and use it as CSR? I need the CSR for HPKP backup key generation. Is OpenSSL the only way to ...
1
vote
0answers
49 views

CSR and private key generated twice but still prone to drown attack

we generated the CSR and private key Installed SSL cert and was Graded F as our server was prone to DROWN attack. Somehow the private key was the same as another key of an existing server that has ...
0
votes
1answer
32 views

What threats and mitigations are there for a CA when processing a CSR?

Question What kinds of technical nastiness/attacks should I look for in a Certificate Request (CSR) ? Assume the ASN1 parser is secure on the CA. I'm strictly concerned with the process of ...
0
votes
1answer
393 views

How can a CSR be generated by OpenSSL without the public key

Ok, so the general steps to make a Certificate Signing Request are (as I understand it) as follows: Generate a key pair Put my identifying information and the public key (or its hash) into a document ...
3
votes
1answer
385 views

Why does the CSR contains an explicit curve when generating private key with genpkey?

When I generated the SSL key using ecparam, I got a CSR with a named curve: $ openssl ecparam -genkey -out ecparam.key -name prime256v1 $ openssl req -new -sha256 -key ecparam.key -out ecparam.csr -...
2
votes
1answer
147 views

Invalid CSR when using Let's Encrypt web tools

I've created a CSR using IIS. When I paste the text here... https://www.sslshopper.com/csr-decoder.html ... it validates correctly. But when I use the Let's Encrypt tools here... https://zerossl....
2
votes
0answers
37 views

CSR Generation for Root and Subdomain FQDNs [duplicate]

I need to secure services operating under my root domain (e.g. example.com) and one or more services operating under subdomains of that root domain (e.g. api.example.com, mail.example.com, etc). I can ...
2
votes
1answer
31 views

Checking the certificate sent back by the CA

If a client sends a CSR to the CA and gets back a certificate signed by the CA, then is it standard practice for the client to verify if the certificate is indeed signed by the CA or can the client ...
0
votes
2answers
869 views

SSL certificate for server authentication

to clear my understandings: I create self signed certificate first keytool -genkey -alias mysign -keyalg RSA -keystore mykeystorename.jks the firstname of the self sign has to be my domain name? ...
0
votes
1answer
241 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
2
votes
1answer
659 views

How is PKCS#10 and x509 related?

I'm unable to make sense of them using the RFCs. Can anyone help? When I use this function, http://www.pyopenssl.org/en/stable/api/crypto.html#x509req-objects , am I creating a PKCS#10 format CSR?
-1
votes
1answer
312 views

Generate CSR code on local machine

I've tried activating an SSL cert. When it asked for the CSR code, I was thinking about generating this code on local machine because I haven't rented my own VPS yet. The thing is, I'm not sure ...
1
vote
1answer
251 views

Have a CSR signed twice

For a customer we need to order a SSL certificate, normally this would be done by their help-desk and we provide the CSR. But as the old certificate will expire soon, and their help-desk need about 7 ...
3
votes
1answer
1k views

Why does SubjectAltName not turn up in my CSR?

Does the CSR generated contains the SubjectAltName I have configured the openssl.cnf file to support extensions and when i dump the CSR i can see subject is available not the SubjectAltName This is ...