So I have my own CA for self-signing SSL certs, but I lost my root certificate. I have a few dependent certs that list the subject info of my root cert. I have my CA's private key and the password to unlock it. Given how public-key crypto works, it seems like it should be possible to re-create my root certificate from the key, but my google-foo and the manpage for openssl have failed me.
2 Answers
If you have stored the private key as PEM file you have a file which looks like this:
-----BEGIN RSA PRIVATE KEY-----
base64 encoded data
-----END RSA PRIVATE KEY-----
This file actually contains both the public and private key and the public key could be extracted by running
openssl pkey -pubout -in key.pem
To create a new CA based on this key just follow the usual instructions. The only difference is that you don't create a new key but use your existing one.
When creating the new CA make sure that you use exactly the the information as you did in the original certificate. They must match the issuer information in the already generated certificates. If they don't this new CA is not even considered as a possible issuer of the leaf certificate. But once these information match validation should be successful because still the same key was signed to use the certificate.
-
This will also work with the PKCS #8-type keys (-----BEGIN PRIVATE KEY-----). If you just need a certificate, the private key is all that is needed, the openssl req -new -x509 -days 1826 -key ca.key -out ca.crt command given in the "usual instructions" link given above will take care of it. Jul 16, 2019 at 20:25
Steffen's answer is better if you can't find a backup of the original root certificate somewhere. However, you may have copies of it lying around in places like applications or trust stores that needed it imported for trust purposes. Did you ever import the CA's cert anywhere like that?
answered Sep 2, 2015 at 3:47
-
The public key is usually contained in the same file as the private key. Sep 2, 2015 at 4:34
-
You are indeed correct and I mis-typed. I meant to say you can't re-create the public certificate, but apparently that is also wrong. Have an upvote, sir. Sep 2, 2015 at 4:55
-
2It's worth adding that if the root certificate is not found in a trust store anywhere, that there's really no value to the existing private key; root CA keys are only useful because of the trust in the certificate. If truly no copies of the root certificate remain, the OP won't lose anything by starting again with a new key.– CalrionSep 2, 2015 at 7:21