Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 4 down vote favorite
2

I just read this article on Wikipedia: Certificate Signing Request

I'm not a PKI or Crypto expert. As I understand, a CSR (certification request) is always signed by the PKCS#10-Request creator.

What I don't understand is why the CA, which receives and processes the CSR, then removes this signature (I mean, without this signature a CA could possibly alter attributes of the CSR).

Why does a CA not just add the necessary attributes to the CSR and sign it with its private key?

share|improve this question
2  
Wouldn't that effectively make a CSR mandatory? Or would you propose two different certificate formats, one with a signed CSR in it and one without? – David Schwartz Mar 10 '12 at 8:16
2  
Now we have 2 formats: CSR and X.509. In my world only X.509 would exist but in two different "flavors": self-signed certificates and self-signed certificates which are signed by a CA (the CA only adds additional attributes and its signature to it). – Mike Mar 10 '12 at 17:50
3  
So how would a CA sign a certificate without a CSR? – David Schwartz Mar 10 '12 at 21:46
2  
At the moment afaik X.509 does not allow to attach a second signature to a self-signed certificate. In "my world" you would be able to send a self-signed certificate to the CA (since I'm a web developer, for example to an URI www.myca.com/cert/sign), then the CA adds additional attributes to it and sign this "extended cert" with its own private key. – Mike Mar 11 '12 at 0:33
2  
btw: I've asked this question because I'm developing an app which creates a self-signed certificate for the user. This cert needs to be "confirmed" by a central CA. How does it work: The app sends the self-signed cert to the CA which issues a new cert with the users public key in it. This process is very simple and also I would have no clue how to implement CSR in different languages (javascript, perl etc..) – Mike Mar 11 '12 at 0:46

2 Answers

up vote 5 down vote accepted

If the CA issued something with a CSR as the dominant part of the To-Be-Signed field, it wouldn't be a X.509 certificate and hardly any existing software would know what to do with it. I guess the original CSR could be added as an extension, though.

Therefore, I suppose you are really asking why the X.509 certificate format wasn't originally specified to include the signatures of both the subject and issuer. I guess the reason was that if a PKI application trusts a specific CA, then that application trusts that the CA adds correct information (pairing a subject with a public key) in all of the certificate fields before issuing it. Adding the signature of the subject wouldn't add anything security-wise.

share|improve this answer
up vote 3 down vote

The answer is simple: The original signature of a CSR is not needed in a signed certificate issued by a CA. If a CA does somthing wrong (e.g. change attributes of the CSR), the CSR creator doesn't have to use the cert (since he's the only holder of the private key, he is also the only one who could use it -> create signatures).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.