I need a certificate to exchange a data with some service provider. This provider suggests to use OpenSSL, they provide example for every step to create a certificate:

  1. Create new private key.
  2. Create certificate request (CSR) based on the private key from Step 1.
  3. Send them CSR and upon receiving new certificate, merge it with a key from Step 1.
  4. Use certificate with key to sign a data.

I tried to replicate these steps with Microsoft CA:

  1. In the Certificates snap-in I created manual certificate request (*.req that I believe is the same as *.csr). There were no options to indicate which key to use
  2. I sent them request and successfully received certificate without key
  3. When imported this received certificate into my Personal store, a key was added automatically (to my surprise) but I have no idea what was that key.
  4. Now I can export this certificate with a key (*.pfx) and able to sign the data. However, service providers reports error ("signed by unknown certificate").

The question is: what was a key used to create CSR? What was a key that was merged? Where is error in my steps?


In the Windows Certificates snap-in, if you can export the private key, the key is also in your certificate store. This may be because you generated the request and imported the public cert on the same computer.

Most TLS user agents verify that the certificate chains to a root that they trust. Either send the user the public cert of your root CA and they trust it, or sign your cert with one of the generally trusted "public" CAs.

  • The question is whether the private key was generated at the same moment of the csr creation or it is one, "common" key for the whole CA. Could it be so that a wrong key was associated with public cert? The error that I expirience is tied to the private key that is using for signing. Nothing to do with TLS and roots. – Niksr Jun 16 at 12:20
  • It will be a different key, otherwise it would be the same cert. Please edit your question to add the specific procedure you used to create this certificate (request). It may help to include fingerprint aka thumbprint, so you know exactly what cert you are referring to. – John Mahowald Jun 16 at 23:29
  • I used Microsoft CA to create CSR, it is mentioned in my question, and I believe there is only procedure to do that (Certificate snap-in -> Create Custom Request -> Proceed without enrollment policy -> PKCS # 10). I have learned that during CSR issuance a key pair (public key + private key) is creating. CSR contains public key. Service provider's CA issues certificate based on my CSR and adds back my public key. My CA upon receiving this certificate adds my private key to it to based on its public key and saved associating public + private key created when I issued CSR. – Niksr Jun 17 at 8:47

What was a key used to create CSR?

Client generates unique key pair: public and associated private key. Then client constructs CSR with public key inside. Private key keeps saved by client.

What was a key that was merged?

When client receives the certificate, it matches public key that remains untouched with saved private key and performs association.

Where is error in my steps?

Most likely there is a misconfiguration on the service provider side. Microsoft CA issues the same certificates as OpenSSL does.

Credentials for answer go to Vadims Podāns, aka PowerShell CryptoGuy

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.