Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up SSL on an Ubuntu server. One of fields it asks for as part of setting up the CSR is a "challenge password". What is that? The default is blank. Do I need to enter one?

share|improve this question
up vote 106 down vote accepted

The "challenge password" requested as part of the CSR generation, is different from the passphrase used to encrypt the secret key (requested at key generation time, or when a plaintext key is later encrypted - and then requested again each time the SSL-enabled service that uses it starts up).

Here's a key being generated, and the beginning of the generated key:

[madhatta@anni tmp]$ openssl genpkey -algorithm rsa -out foo.key
[madhatta@anni tmp]$ head -3 foo.key

This key has no passphrase. I wasn't prompted for one at creation, and haven't entered one. Now, let's generate an encrypted key:

[madhatta@anni tmp]$ openssl genpkey -algorithm rsa -des3 -out bar.key
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
[madhatta@anni tmp]$ head -3 bar.key

So it should be clear what an encrypted private key (which apache, or any other SSL-enabled server, will need unlocking for it when it starts) and a plaintext private key (which doesn't require unlocking at service start time) look like. Now I'll generate a CSR with a challenge password from the unencrypted key:

[madhatta@anni tmp]$ openssl req -new -key foo.key
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:asdfasdf
An optional company name []:

And just to show that the key hasn't magically become encrypted:

[madhatta@anni tmp]$ head -3 foo.key

So I say again: the "challenge password" requested as part of the CSR generation is not the same thing as a passphrase used to encrypt the secret key. The "challenge password" is basically a shared-secret nonce between you and the SSL certificate-issuer (aka Certification Authority, or CA), embedded in the CSR, which the issuer may use to authenticate you should that ever be needed. Some SSL certificate-issuers make that clearer than others; look down at the bottom of this page to see where they say the challenge password is needed - it's not when you restart apache:

Should you choose to enter and use a challenge password, you will need to make sure that you save that password in a secure place. If you ever need to reinstall your certificate for any reason, you will be required to enter that password.

share|improve this answer
Is there a difference between an "SSL Issuer" and a CA (Certificate Authority)? – Jonathan Leaders Apr 16 at 1:30
I don't think so; would you prefer that I used the alternative term? – MadHatter Apr 16 at 5:20
Technically they aren't issuing the SSL protocol itself, but rather a SSL compatible certificate. I feel like SSL issuer is less clear. SSL Certificate Issuer would be clear, in my humble opinion. – Jonathan Leaders May 16 at 8:59
@JonathanLeaders ok, I have so changed it. Hope that's better, and thanks for helping clarify matters. – MadHatter May 16 at 9:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.