Hot answers tagged

34 votes
Accepted

Why create a CSR on my own server to have it signed by a 3rd party?

My question is: What could the reason be that we (the previous sysadmin) would create the CSR etc, instead of just letting the customer create the certificate fully on their side, and when it's ...
Gh0stFish's user avatar
  • 10.2k
15 votes

Why create a CSR on my own server to have it signed by a 3rd party?

What could the reason be that we would create the CSR? In the first phase you do not create just a CSR, but a key pair. The CSR is derived from the public key of that pair, to be signed with the ...
Esa Jokinen's user avatar
  • 18.9k
13 votes
Accepted

CSR expiry date / validity date

Correct. The relevant standard is the X.509 spec in RFC5280: 4.1.2.5. Validity The certificate validity period is the time interval during which the CA warrants that it will maintain ...
Mike Ounsworth's user avatar
6 votes
Accepted

What is the risk of someone intercepting my CSR and private key

If you do it properly, nothing. The usual process for getting a TLS (formerly SSL) certificate from a CA is: Generate server.privkey and server.csr (or equivalent) files on your machine. Keep the ...
Mike Ounsworth's user avatar
5 votes
Accepted

Why is generating Certificate Signing Request (CSR) supposed to be platform/machine specific?

Generating CSR is not platform specific, it's true as you say, that you only need the primary key and private key isn't tied to a specific machine. However, especially in a beginner's tutorial, there ...
Lie Ryan's user avatar
  • 31.5k
5 votes
Accepted

How is public key included in the CSR?

You have a few misconceptions in your diagram. The most important is that both your encrypt boxes are wrong, they should say sign. Following from that, the CSR sent to the CA includes the various ...
Marc's user avatar
  • 4,271
4 votes
Accepted

Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?

To sign the CSR: openssl x509 -req -days 365 -in private.csr -signkey ca.key -out test.crt From man x509: -signkey filename ... If the input is a certificate request then a self signed ...
Steffen Ullrich's user avatar
4 votes

How is CSR encrypted?

How is CSR encrypted? It is not encrypted at all. What you see is PEM encapsulation of the binary CSR. This encapsulation uses Base64 encoding. The CSR itself is ASN.1 encoded, which basically is a ...
Steffen Ullrich's user avatar
4 votes
Accepted

Automatic Certificate Signing Request (CSR) Validation

A CSR by itself is valid if the signature on the CSR fits the public key in the CSR. Anything else is subject to use case specific constraints, i.e. depend on what the certificate should be used for. ...
Steffen Ullrich's user avatar
3 votes
Accepted

Multiple CSRs from the same private key

As per this answer CSR with only public key with openssl The CSR only contains your public key, not your private key, so your private key has not been compromised. The .csr files will both still be ...
ste-fu's user avatar
  • 1,092
3 votes
Accepted

How to generate CSR(Certificate Signing Request) using C++ and openssl

If you compare the output from openssl req -in yourcsr.pem -text with CSR created by the usual openssl commands you will find, that the version is shown as 1 in your CSR while 0 in the usual CSR: ...
Steffen Ullrich's user avatar
3 votes
Accepted

How and in what context CSR works?

A CSR allows a user to get a certificate authority (CA) to give them a signed certificate, without the CA actually knowing the user's private key. An X.509 cert has a few major pieces: the subject (...
CBHacking's user avatar
  • 47.7k
3 votes
Accepted

Which OpenSSL commands update the CA database index file?

This is correct. openssl x509 is only a tool to manipulate and create certificates, but it is not a standalone CA and does not keep any status. Whereas openssl ca is described in the documentation as: ...
Steffen Ullrich's user avatar
3 votes

Why does SubjectAltName not turn up in my CSR?

As indicates by @StackzOfZtuff, the problem is you aren't telling openSSL to include SAN in your CSR. A guide on doing so can be found here, and basically suggests doing: [ req ] default_bits ...
iwaseatenbyagrue's user avatar
3 votes
Accepted

Is the CSR and public key the exact same thing?

No, they are not the same. A public key is actually one member of a "key pair", consisting of both a public key and the matching private key. The CSR is a Certificate Signing Request, which is just ...
John Deters's user avatar
  • 34.2k
3 votes
Accepted

How can a CSR be generated by OpenSSL without the public key

A private key isn't just a big number, it is actually a data structure with several numbers in it. Here's what a public key looks like (RSA): <RSAKeyValue> <Modulus>...
John Wu's user avatar
  • 9,311
3 votes

Why does the CSR contains an explicit curve when generating private key with genpkey?

Inconsistent defaults Re. 2. Re. 2: Dunno. But it seems wrong to give a named curve explicitly and let the other end figure out Hey! That's actually one of the named curves I support! The OpenSSL Wiki ...
StackzOfZtuff's user avatar
3 votes

Convert CSR to self-signed x509 Certificate

Self-signed certificate means that the certificate is signed by itself. Since signing is done with the private key you need the private key which matches the public key in the certificate. This means ...
Steffen Ullrich's user avatar
3 votes

Convert CSR to self-signed x509 Certificate

By definition, a self-signed certificate is the certificate that uses private key associated with the public key in the certificate to sign itself. Public key in the certificate is used to verify the ...
Crypt32's user avatar
  • 6,281
3 votes
Accepted

Help understanding CSR fields

RFC2986: PKCS #10: Certification Request Syntax Specification describes CSRs in detail. The overview answers most of your questions: The process by which a certification request is constructed ...
Marc's user avatar
  • 4,271
3 votes
Accepted

Is certificate signature encoded to ASN.1 format?

TLDR: Yes, everything in a CSR or a certificate is using ASN.1 notation, ASN.1 is a description of the data types. There are a few things to unpack here but let's start with some definitions: Data ...
Marc's user avatar
  • 4,271
3 votes
Accepted

I am unable to use an RSA key generated with the -aes-256-gcm option in openssl, help

WRT, "I am unable to generate and use an aes-256-gcm key in openssl": Understand that openssl genrsa is used to generate an asymmetric RSA key pair. openssl genrsa is not used to generate a ...
mti2935's user avatar
  • 23.4k
3 votes
Accepted

openssl csr generation with basicConstraint=CA:False

... how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False The -extensions parameter is not used at all when generating a CSR. It is used for ...
Steffen Ullrich's user avatar
3 votes

What is the purpose of "certificatePolicies" in a CSR? How should an OID be used?

However, I'm still unclear what the purpose of this value is, and how it should be used. There is no purpose for this specific value, i.e. it is just a made up value used as example. And it does not ...
Steffen Ullrich's user avatar
3 votes
Accepted

Can any field in a CSR be overwritten in the issued cert?

The issuing authority has no requirement or responsibility to respect anything in the Certification Request (CSR), except the public key. The StartSSL Certificate Authority, for example, did exactly ...
bartonjs's user avatar
  • 1,878
2 votes
Accepted

Use externally generated CA cert to sign CSR's in OpenSSL

Yes, you can. You just need to have the private key in the proper format to be used by openssl. Not knowing in which format you exported, it's impossible to provide commands, but -supposing it can't ...
Ángel's user avatar
  • 18.8k
2 votes

How is PKCS#10 and x509 related?

PKCS#10 is a specification defining what and how attributes should be contained in a Certificate Signing Request in order for it to be compliant. It is used as the default specification for most ...
Dave Satch's user avatar
2 votes
Accepted

Invalid CSR when using Let's Encrypt web tools

I needed to remove "New" from the text -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- The second of the tools was using a Regex which wasn't looking for ...
Ian Warburton's user avatar
2 votes

Why is generating Certificate Signing Request (CSR) supposed to be platform/machine specific?

A CSR is just a signing request, as long as you have the private key used for the CSR, the signed certificate you get via that CSR and they key can be used anywhere on any machine. By telling users ...
John Keates's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible