When creating a certificate signing request, there is a part where openssl says "Please enter the following extra attributes to be sent with your certificate request". One of these is a challenge password.

Under what circumstances will this password be needed?

  • $\begingroup$ I think this is a password that looks strangers out from actually looking at the contents of the CSR (e.g. enlisted name, state, city, emails, public keys, ...) $\endgroup$ – SEJPM Jul 16 '16 at 18:43
  • $\begingroup$ But this password is not used to encrypt the CSR. So I would not imagine its used to obfuscate the contents of the CSR $\endgroup$ – Minaj Jul 16 '16 at 19:02
  • $\begingroup$ If you want you can remove this prompt (and attribute) and/or unstructuredName, and/or in principle add others but I know no sensible others to add, in the section identified by the attributes setting in the [req] section of your config file, normally [req_attributes]. $\endgroup$ – dave_thompson_085 Jul 17 '16 at 1:56

From RFC 2985:

The challengePassword attribute type specifies a password by which an entity may request certificate revocation. The interpretation of challenge passwords is intended to be specified by certificate issuers etc; no particular interpretation is required.

This has also come up over at Information Security Stackexchange with the TL;DR being it's the password you set during the certificate request to share a revocation password with the CA, this however is rarely to never used in practice, because CAs nowadays have "normal" log-in mechanisms just like any other website and use them control revocation.

  • $\begingroup$ This means certificate revocations are necessarily requested by the certificate owners? Otherwise any third parties would not have access to this password $\endgroup$ – Minaj Jul 16 '16 at 19:46
  • $\begingroup$ @Minaj certificate revokations are always issued by the CA (usually upon request of the owner or his authorized delegate). Because random really should not be allowed to let certificates be revoked arbitrarily. Only image I could revoke the google certificate now... $\endgroup$ – SEJPM Jul 16 '16 at 19:50
  • $\begingroup$ Ohh, I was under the impression that some third party standards organisation can also request for a revocation if a certain site is found to be "crooked" $\endgroup$ – Minaj Jul 16 '16 at 20:08
  • $\begingroup$ @Minaj, I guess if some organisation with enough authority asks hard enough (maybe with the power of law?) then surely they can also enforce revokation of a specific certificate, but certificates are CA's core business and as such they have to meet relieability standards and such and thus won't revoke anything without a very good reason (except if the customer requests it himself) $\endgroup$ – SEJPM Jul 16 '16 at 20:11
  • 1
    $\begingroup$ @SEJPM I guess proving access to the private key would do the trick :) $\endgroup$ – Maarten Bodewes Jul 16 '16 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.