0
$\begingroup$

I created a root CA, let's say A.
I created the Certificate Signing Request (CSR) for B, and get the certificate signed by A. I would like to know of what exact content the signature is made.

This is my root CA Key:

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA1YlHGeuAr2VUYjKzJYhdKcSiJwAwJRofOvmrYt5QgAhjEMZO
Omqu5gP9U9TqNvzQO3KPOYZCbbE3hRAGX8xRqNH/qhlFFSeHlv4W5w1vv2LHeq+q
09ugXydm9+XgUEX22lUD8YkveT5ZMEq5ZJ30Lz9Ii55NjYf04n36KRGKOAKYZdCs
1+EHEBOyHLiF09zl7MRgBjsk3eVI/mcooeGC0JZqAA2S3iccP3M9pfzH/dSbBDL+
wBUQvOzaN8hQL84rscoYyMlplYJKlFewuMXQLlQIfVzGhPai+fR8aN1l5ukn3ckC
Nd/7QXCO+ePKYqV/f3iv2Kv7pH68HrCy63zBOwIDAQABAoIBADMrv38loWPmu28A
yU9wOyscNON1txPdC6jdVcXOkqnr2JmXe/2hvSHfyOBDAJGGyfvE+y+EzfxtYGmh
qnVgiB0VndfMUHK+U07KuwBJhwLtD/KFkEFOu0KyNYmoa7Ww3nP5tYU3I8pBN6xL
69uBwpdj6eWTXPBSqUtxdvZKfr3m6SB0ZU0ssRbTQXTGpwTiI21ga3aFckm9ro3l
g7oYqQDltJgOgBA+Psy6QdY5ryXaZY4PmvcBLNzUtEZWTgezFFml5lDiQHouE3rP
x+AfApgh5l/G8l2A0gfInLxxHRBU86mLcGnLztbpMXlNaHAPcT2PBJG6NpkoGHBu
jgRVwGECgYEA9UmN976npQm1d8p41gqxDKLu2E0DJ7MF0IPjIa1zjVrdbp33HoxE
MllnZNrgdG8G38NG48Z6Rs1ZKkeqde7hcR++2J7TSuzR6e0UEH7STAPWUaakpuns
ztQnZicvn7JKTkT9ltKGnWfaspf6D/HwJzwtArxGFDnBct6jUDB1UusCgYEA3ty6
legDT0mBH2iYVRS0lsYYeqbEmbsqcsOS2bomFo6iclUDXU7EmA3VwKDNYHWHZ350
R5iQs3DlapxvvZCI50mNJnYkEKqBcAKkCEpmfRbXQtlvqkyx6UNoonC5gJx8v9V6
2LpwdEBgRlPyA2CngC7RYzEvTuMCgTvlT8ZclvECgYEAv9k/BAYH44q7d61SY79L
CWIqw91AWX2pT5TIQuACYA4w4UMGNMtqz6Kjvvt+0TLBwqRevurPWq9kTTBuf/1O
MQeuYomfI5wk9v0qU1iOLUxXBdf8Ml0GjiLbigeeNR7jBWLqoVuaVGUVZdh+ipgl
yNpFLj2J5mniB3FhdOfh6+8CgYArOXZ68rgJncEMfXXmMpDgGWXQDB5fjryp66LE
1eTjRSDeufxgEZHxx+UoakfLKKBtg0o8RKv0EbZ9WgAWLT1QVqSozAssrFVUiz6T
WRLNuitgDNoqlpt/GZLmxqRD/JX5gwdDl82NzpqdqVRsMUfrhakY6wY477ChriNI
uLlmkQKBgCbVPWJPZeLvs8LCXHHKOUAu+g7AU/7zPsBNcPT7wd47dDQ7Ei1wheUG
lANtZ2lmScSyymlfnKz5yaQXKxWP10UNJblQGO609Wg4sDbVVFah7cfQDHfG0LNb
ZCVRWt8LTlDadLc04FBFofF4Qc78dwMQOFMFpZJc9xp1OZ4BGOEQ
-----END RSA PRIVATE KEY-----

and this is the CSR of B

-----BEGIN CERTIFICATE REQUEST-----
MIICrTCCAZUCAQAwaDELMAkGA1UEBhMCYWExCzAJBgNVBAgMAmFhMQswCQYDVQQH
DAJhYTELMAkGA1UECgwCYWExCzAJBgNVBAsMAmFhMRIwEAYDVQQDDAlhdHRlc3Rf
Y2ExETAPBgkqhkiG9w0BCQEWAmFhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAqVQVwOFDpMsIRceGSf43G+i7NF2NI8kiC4Vgk6yEeqJAdYBVL+Psq3Vi
/SCBQMclXb9B/yV1M/HQvepZDsp7zxl5x0rCCvBY5zd65Dzb5JLz3TtrFkJvxaDl
qF32gfIw/vwHmtbHZYXiqVJZwOco0I3KTOZpDCeIHy6M+3cm6hjN659i+IHkihUV
F2cZ1pu7To5NbkeqxtTxpIsaJXu/9yxgM4w9iilEmi7A6TDtLPKhDNkQzOo1Pa9F
FEsb5R0f/zpCz7vPQVeYFk72HcEHA8OtMy7EvNcapIbrPlVoRsjk66StJ1sKoBN7
xk2UlG/1U3CBR/KmZc7/4dhYtWbg6wIDAQABoAAwDQYJKoZIhvcNAQELBQADggEB
AHyEo+Xl3oxvsE4ft9QkrBjE+JwBqCi5eSk2Fxer0bfcilyCy3bkWN+qSU2JAOOn
pSoytgNnGEz/ZR37ZLAU7I3abecpahshkPq+YXngex0q0PuMWaO5+p+T4gwZLpNB
rj5+dXk4hoeWJDmpNjv2me7CCBvBZIdsx84utpLyuf9kuLULUbfkLMgn2klEu803
+B2uMr92zbOudNTscg0IK6DwuU/gupN15s7k4Dw3EfHuw/Wk/5pDkHSz/ruKMf13
FZUSoV4r3AtQhpmKOPxjS4ciBGAFwReLOjCprDbpDrqEN6QwMy5Bb/Ganee6SUca
kdydtt1K5PCndZhCsyxuwEo=
-----END CERTIFICATE REQUEST-----

and this is the certificate of B.

-----BEGIN CERTIFICATE-----
MIIDvDCCAqSgAwIBAgICASAwDQYJKoZIhvcNAQELBQAwXTELMAkGA1UEBhMCSUwx
CzAJBgNVBAgMAk5JMREwDwYDVQQHDAhMb2NhdGlvbjEMMAoGA1UECwwDUiZEMQ4w
DAYDVQQKDAVURUxJVDEQMA4GA1UEAwwHY2FfY2VydDAeFw0xNzA3MTQwNDA2MzBa
Fw0xODA3MTQwNDA2MzBaMGgxCzAJBgNVBAYTAmFhMQswCQYDVQQIDAJhYTELMAkG
A1UEBwwCYWExCzAJBgNVBAoMAmFhMQswCQYDVQQLDAJhYTESMBAGA1UEAwwJYXR0
ZXN0X2NhMREwDwYJKoZIhvcNAQkBFgJhYTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAKlUFcDhQ6TLCEXHhkn+NxvouzRdjSPJIguFYJOshHqiQHWAVS/j
7Kt1Yv0ggUDHJV2/Qf8ldTPx0L3qWQ7Ke88ZecdKwgrwWOc3euQ82+SS8907axZC
b8Wg5ahd9oHyMP78B5rWx2WF4qlSWcDnKNCNykzmaQwniB8ujPt3JuoYzeufYviB
5IoVFRdnGdabu06OTW5HqsbU8aSLGiV7v/csYDOMPYopRJouwOkw7SzyoQzZEMzq
NT2vRRRLG+UdH/86Qs+7z0FXmBZO9h3BBwPDrTMuxLzXGqSG6z5VaEbI5OukrSdb
CqATe8ZNlJRv9VNwgUfypmXO/+HYWLVm4OsCAwEAAaN7MHkwCQYDVR0TBAIwADAs
BglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYD
VR0OBBYEFFUWxC1g2FZNctMSRNv6f4Qs6NNJMB8GA1UdIwQYMBaAFEgmfn6A6GJM
/GoDeqk5zys7tLhfMA0GCSqGSIb3DQEBCwUAA4IBAQA7MziWkbYcxOSGbAKEOVXB
thrI6CWpVfvv+fHqLZtYDElMc4Aa1sKfgju05ysIFMvKZrexqTyqptEdylIT6Vie
kgfyNPQmztYHONWmc/Y7D4Gd1AfnYQ3h3fthl/dDDZoO6Fd6MvbhxMDTX3uTIhiM
QuyN5knpORxnwNM5fIwKU7nNs5ZEmzMLtFpO558Wro+IMspX0iQmvSqKkLU94nOI
SNH8p6rpU4ilWzCZT55lhd19aZkXP5WfjOzwFPiLoP2f2ktfAG7cAeOBqjHBPmtG
5yEan5bOOL87kr1rz2OYf9Xd8Pffe5Jj7jTqLq2hZGFGsAXm3A+4xrtFNL6AJ7kp
-----END CERTIFICATE-----

and this is the signature part of the above certificate:

Signature Algorithm: sha256WithRSAEncryption
     3b:33:38:96:91:b6:1c:c4:e4:86:6c:02:84:39:55:c1:b6:1a:
     c8:e8:25:a9:55:fb:ef:f9:f1:ea:2d:9b:58:0c:49:4c:73:80:
     1a:d6:c2:9f:82:3b:b4:e7:2b:08:14:cb:ca:66:b7:b1:a9:3c:
     aa:a6:d1:1d:ca:52:13:e9:58:9e:92:07:f2:34:f4:26:ce:d6:
     07:38:d5:a6:73:f6:3b:0f:81:9d:d4:07:e7:61:0d:e1:dd:fb:
     61:97:f7:43:0d:9a:0e:e8:57:7a:32:f6:e1:c4:c0:d3:5f:7b:
     93:22:18:8c:42:ec:8d:e6:49:e9:39:1c:67:c0:d3:39:7c:8c:
     0a:53:b9:cd:b3:96:44:9b:33:0b:b4:5a:4e:e7:9f:16:ae:8f:
     88:32:ca:57:d2:24:26:bd:2a:8a:90:b5:3d:e2:73:88:48:d1:
     fc:a7:aa:e9:53:88:a5:5b:30:99:4f:9e:65:85:dd:7d:69:99:
     17:3f:95:9f:8c:ec:f0:14:f8:8b:a0:fd:9f:da:4b:5f:00:6e:
     dc:01:e3:81:aa:31:c1:3e:6b:46:e7:21:1a:9f:96:ce:38:bf:
     3b:92:bd:6b:cf:63:98:7f:d5:dd:f0:f7:df:7b:92:63:ee:34:
     ea:2e:ad:a1:64:61:46:b0:05:e6:dc:0f:b8:c6:bb:45:34:be:
     80:27:b9:29

So I would like to know, since I have the root CA private key and the CSR of B how to find out the mechanism to generate the signature in the certificate B. Can someone explain me how to recompute the signature?

$\endgroup$
  • $\begingroup$ Note the CSR is of no use here; the contents of the cert are NOT the same as the contents of the CSR, and the cert signature covers the tbs of the cert not the tbs of the CSR. $\endgroup$ – dave_thompson_085 Jul 15 '17 at 4:12
1
$\begingroup$

The signature of a X.509 certificate is computed over the DER encoding of the ASN.1 type TBSCertificate which is defined in RFC5280.

$\endgroup$
  • 1
    $\begingroup$ If using OpenSSL, as the posted format implies, you can extract tbs using openssl asn1parse <certpem to identify its starting offset and then adding -strparse N >tbsder $\endgroup$ – dave_thompson_085 Jul 15 '17 at 4:15
  • $\begingroup$ You are welcome @SaratG . If you are satisfied, please accept the answer as the correct one. $\endgroup$ – mat Jul 18 '17 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.