I am using Digicert for buying SSL certificate and its giving me different files on demand as

  • DigiCertCA .crt .pem
  • star_evercam_io .crt .pem
  • TrustedRoot .crt .pem

am totally unaware that how can i have PRIVATE KEY from this. What i need to do is send SSL certificates to AWS with this command

aws iam upload-server-certificate --server-certificate-name myServerCertificate --certificate-body file://public_key_cert_file.pem --private-key file://my_private_key.pem --certificate-chain file://my_certificate_chain_file.pem

Totally confused about where to put which file. and how to create PRIVATE KEY from this. any one familiar with this issue then please help , i have been searching around for 3 weeks on this topic but all i vain

PS: I tried to create Private key with many commands mentioned over Stackoverflow but with those private keys i always get error from aws as

A client error (KeyPairMismatch) occurred when calling the UploadServerCertificate operation: The private key did not match the public key provided. Please verify the key material and try again.
  1. buy your ssl certificate from DigiCert
  2. Follow the instruction to generate your public/private key
  3. upload to aws: aws iam upload-server-certificate --server-certificate-name <make-up-a-name> --certificate-body <public-key-file-path> --private-key <private-key-file-path> --certificate-chain <certificate-chain-path>

Now the only part that could be messy here is the certificate-chain. AWS is picky about its format. Basically it contains the 3 files your mentioned (DigiCertCA,star_evercam_io,TrustedRoot) all concatenated into one long text file. If you come to the point where the aws command gives you an error about this, post another question.

  • 2
    Umm, you should never get a private key from a CA. The private key should only ever be generated by the request or, and not provided to any other party. – EEAA Jan 12 '16 at 14:06
  • Hear, here! Tal, if digicert actually provides the service you're suggesting, they should never be used by anyone who values their security. – MadHatter Jan 12 '16 at 14:09
  • of course :) you get your certs by following the instructions on digicert. the issuer doesn't provide the key. updated the answer. – Tal Jan 12 '16 at 14:24

You cannot create or extract a private key from a certificate; if you could, SSL would be pointless. You created the key first, as a pre-requisite to creating the CSR that you submitted to digicert, in order to get them to give you a certificate.

So, go back to the machine and the directory where you created the CSR; the private key is likely somewhere around there.

Edit: as digicert's own support page says:

Before you can order an SSL Certificate, you must first generate a CSR (Certificate Signing Request) for your server.

If you've actually paid them money, and got your certficate from them, you must have generated a CSR, which meant generating a private key (and the corresponding public one).

If you haven't yet generated and submitted a CSR, then whether you've paid or not, you don't yet have your certificate - you've only got a bundle of intermediate certificates, which (though they'll be needed later) aren't what you need right now. Go through the process of creating and submitting your CSR, and in so doing, you'll create the private key.

  • i didnt give anything to Digicert – Junaid Farooq Jan 12 '16 at 13:52
  • @JunaidFarooq If that's true, their process is horrendously insecure. – ceejayoz Jan 12 '16 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.