openssl generate .key from CSR

Question

A customer sent me a CSR and the .CER of a certificate for a linux server that I host. The customer does not have access to this machine.

Is this enough data to generate a valid certificate? Is it possible to generate the .KEY from the .CSR for a valid certificate?

Check the contents of the files - sometimes people put the private and public keys in the same file. — Shane Madden, Nov 25 '13 at 20:10

score 7 · Answer 1 · answered Nov 25 '13 at 19:41

7

You can't derive the private key from the certificate (signed public key) or the certificate signing request. If you could, the crypto would be utterly useless.

answered Nov 25 '13 at 19:41

Michael Hampton

244,070
43
506
972

score 1 · Answer 2 · answered Jun 01 '16 at 10:18

The CSR (Certificate Signing Request) alone is enough to generate a valid certificate. The CSR has all of the requested details of the certificate (Subject name, location, organization, etc.) along with the public key. The private key however is stored on the machine that generated the CSR (presumably the server requiring the cert, but not necessarily) and is NOT included in the contents of the CSR, and may not be derived from the CSR. It is kept private.

In general terms, the server generating the CSR generates a key pair (public and private). It then uses the private key to pack up the requested information (including the public key) and sends it off to be signed, keeping the private key in a separate location.

openssl generate .key from CSR

2 Answers2