Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need an SSL certificate for an HTTPS server. I'd like to offer the choice between self-signed and CA-signed certificates.

I can generate a self-signed SSL certificate with the following OpenSSL commands:

openssl req -newkey rsa:512 -x509 -days 365 -nodes -out cert.pem -keyout cert.pem
openssl dhparam -inform pem -in cert.pem -outform pem -out dhparam.pem 512
cat dhparam.pem >> cert.pem

If I want to have a CA-signed certificate, I can generate a CSR (Certificate Signing Request) :

openssl req -newkey rsa:512  -nodes -out cert.csr -keyout cert.key

And send it to one CA. And then ? I'm wondering what the CA is sending back : only the certificate, or the certificate and the DH parameters since they are used in the negotiation between the browser and the server ?

[was asked on StackOverflow]

EDIT: it seems CAs only deliver the certificate, which mean I'll need to concatenate

  • the private key
  • the certificate
  • the DH parameter

Could someone please confirm ?

share|improve this question
up vote 2 down vote accepted

Yes, a Certificate Authority takes your Certificate Signing Request and generates a signed certificate, which you then use on your website. The DH parameters aren't certificate specific, so there's no reason for the CA to get involved there, and obviously sending your key to anyone is a bad idea.

share|improve this answer

The certificate is simply a digital signature that can "verify" your public key's values (CN, OU, expiry, etc.) and be validated as having been made by the CA. I'm not sure about your 'concatenate' comment, but you've basically nailed it.

Everything else is set and specified at your end - the private key (which is kept secret on your server), the public key (sent to everyone that asks for it), and the SSL negotiation parameters (set by your web server software.)

(In my experience, confusion often arises simply because of the various different formats of files that the keys, signatures, certificates, CSRs, etc., can be stored in.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.