2
$\begingroup$

Is there a way to generate a certificate with a pre-stablished public/private plaint text keys?

Explaning: I generated some keys on a web site for development propurses, but now one of the parties requires it on a X509 certificate...

Sample keys can be generated here: http://travistidwell.com/jsencrypt/demo/

$\endgroup$
  • $\begingroup$ Generally we try and use 2048 bits keys or larger for RSA (and DH). 1024 bit keys are still safe, but chances are that somebody will show a break of one of these in months / years to come - they only have a strength of about 80 bits after all. $\endgroup$ – Maarten - reinstate Monica Jan 21 at 18:41
3
$\begingroup$

Yes, of course this is possible.

Generally you are required to first create a certificate (signing) request or CSR - a specific structure sometimes also called PKCS#10 after the standard that defines it. The certificate request contains the public key inside of it. This certificate request needs to be signed with the pre-established private key for the certificate. This certificate request can processed by a local or remote certificate authority, which returns the certificate. Commonly the certificate or certificate chain and the private key then need to be stored together into a (PKCS#12) key store.

Alternatively you should also be able to directly to create a self-signed certificate. Again, the public key is contained in the certificate. And again, the private key is required to perform the signing.

Note that the public key is commonly also contained in the (PKCS#1 or PKCS#8) structure of the private key. This means that you may not have to explicitly include it in any commands for creating the certificate request or self-signed certificate.


I found some answers on this page on how to do this with OpenSSL:

Generate a CSR from an Existing Private Key

openssl req \
       -key domain.key \
       -new -out domain.csr

Generate a Self-Signed Certificate from an Existing Private Key

openssl req \
       -key domain.key \
       -new \
       -x509 -days 365 -out domain.crt

here the domain.key is the OpenSSL PEM encoded private key.


I've tested both methods successfully after copying the private key to a file called domain.key. If this goes wrong, it's likely because of copying or system issues.

$\endgroup$
  • 1
    $\begingroup$ I'm sorry, but I wonder what you are doing wrong. Go inside the private key text block, hit ctrl-A, ctrl-C and put it into a text editor. Note that PEM usually uses Windows line endings (\r\n). You may want to add a final line ending after the footer to be sure. Save as UTF-8, certainly not UTF-16. Then save as domain.key. There, I've tried to cover it all. Please let me know if you've got any success with it. $\endgroup$ – Maarten - reinstate Monica Jan 21 at 23:53
  • $\begingroup$ it worked! it was the key formatting! quick question though: why is the private key not present? the cert only has a public key... $\endgroup$ – Leonardo Jan 22 at 13:50
  • $\begingroup$ The certificate is there to establish trust the public key so it can perform verification. Certificates are public too, obviously distributing the private key doesn't make sense - it must stay private after all. $\endgroup$ – Maarten - reinstate Monica Jan 22 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.