0

I need an SSL certificate for an HTTPS server. I'd like to offer the choice between self-signed and CA-signed certificates.

I can generate a self-signed SSL certificate with the following OpenSSL commands:

openssl req -newkey rsa:512 -x509 -days 365 -nodes -out cert.pem -keyout cert.pem
openssl dhparam -inform pem -in cert.pem -outform pem -out dhparam.pem 512
cat dhparam.pem >> cert.pem 

If I want to have a CA-signed certificate, I can generate a CSR (Certificate Signing Request) :

openssl req -newkey rsa:512  -nodes -out cert.csr -keyout cert.key

And send it to one CA. And then ? I'm wondering what the CA is sending back : only the certificate, or the certificate and the DH parameters since they are used in the negotiation between the browser and the server ?

[was asked on StackOverflow]


EDIT: it seems CAs only deliver the certificate, which mean I'll need to concatenate

  • the private key
  • the certificate
  • the DH parameter

Could someone please confirm ?

2 Answers 2

2

Yes, a Certificate Authority takes your Certificate Signing Request and generates a signed certificate, which you then use on your website. The DH parameters aren't certificate specific, so there's no reason for the CA to get involved there, and obviously sending your key to anyone is a bad idea.

1

The certificate is simply a digital signature that can "verify" your public key's values (CN, OU, expiry, etc.) and be validated as having been made by the CA. I'm not sure about your 'concatenate' comment, but you've basically nailed it.

Everything else is set and specified at your end - the private key (which is kept secret on your server), the public key (sent to everyone that asks for it), and the SSL negotiation parameters (set by your web server software.)

(In my experience, confusion often arises simply because of the various different formats of files that the keys, signatures, certificates, CSRs, etc., can be stored in.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .