I created my privatekey & certificate request using openssl req -new -newkey rsa:65536 > server.cert.csr. This took some minutes and produced 2 files.

Then I decrypted my private key using openssl rsa -in privkey.pem -out server.cert.key

Now I want to self-sign my certificate using openssl x509 -in server.cert.csr -out server.cert.crt -req -signkey server.cert.key -days 365 but this results in an error:

Signature did not match the certificate request

I tried the same procedure using smaller keys (only 4096bits) and then it worked. Is there no way to get a 65536bit long key self-signed?

What exactly is here the problem or is this just a bug? I am sure that I didn't mix private keys or certificate requests.


Sounds like a bug in openssl, but still - 65kb private key will not get you super-safe-vpn, only a super-slow-one (longer encryption/decryption using longer key) - a value of 8kb should be pretty safe for the next decades. I would recommend using 4k key.

It would be actually much safer to rotate the private keys/certificates in a schedule than having a huge encryption key.

Look at this thread and see what crypto experts came up with https://crypto.stackexchange.com/questions/1182/are-there-practical-upper-limits-of-rsa-key-lengths

| improve this answer | |
  • do you know if this bug has already reported? – feedc0de Oct 13 '17 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.