Certificate signing request
In public key infrastructure (PKI) systems, a certificate signing request (also CSR or certification request) is a message sent from an applicant to a certificate authority in order to apply for a digital identity certificate. The most common format for CSRs is the PKCS #10 specification and another is the Signed Public Key and Challenge Spkac format generated by some Web browsers.
Before creating a CSR, the applicant first generates a key pair, keeping the private key secret. The CSR contains information identifying the applicant (such as a distinguished name in the case of an X.509 certificate) which must be signed using the applicant's private key. The CSR also contains the public key chosen by the applicant. The CSR may be accompanied by other credentials or proofs of identity required by the certificate authority, and the certificate authority may contact the applicant for further information.
Typical information required in a CSR::
|Distinguished Name (DN)||This is fully qualified domain name that you wish to secure e.g. 'www.example.com’ or 'mail.example.com'. This includes the Common Name (CN) e.g. 'www' or 'mail'|
|Business name / Organization||Usually the legal incorporated name of a company and should include any suffixes such as Ltd., Inc., or Corp.|
|Department Name / Organizational Unit||e.g. HR, Finance, IT|
|Town/City||e.g. London, Waterford, Paris, New York, Dhaka, Kochi|
|Province, Region, County or State||This should not be abbreviated e.g. Sussex, Normandy, New Jersey|
|Country||The two-letter ISO code for the country where your organization is located e.g. GB, FR or US etc..|
|An email address||An email address to contact the organization. Usually the email address of the certificate administrator or IT department|
If the request is successful, the certificate authority will send back an identity certificate that has been digitally signed with the private key of the certificate authority.
The three main parts that a certification request consists of are the certification request information, a signature algorithm identifier, and a digital signature on the certification request information. The first part contains the significant information, including the public key. The signature by the requester prevents an entity from requesting a bogus certificate of someone else's public key. Thus the private key is needed to produce, but it is not part of, the CSR.
The first part, ASN.1 type CertificationRequestInfo, consists of a version number (which is 0 for all known versions, 1.0, 1.5, and 1.7 of the specifications), the subject name, the public key (algorithm identifier + bit string), and a collection of attributes providing additional information about the subject of the certificate. The attributes can contain required certificate extensions, a challenge-password to restrict revocations, as well as any additional information about the subject of the certificate, possibly including local or future types.
openssl asn1parse -i -in your_request
A CSR may be represented as a Base64 encoded PKCS#10; an example of which is given below:
-----BEGIN CERTIFICATE REQUEST----- MIICzDCCAbQCAQAwgYYxCzAJBgNVBAYTAkVOMQ0wCwYDVQQIDARub25lMQ0wCwYD VQQHDARub25lMRIwEAYDVQQKDAlXaWtpcGVkaWExDTALBgNVBAsMBG5vbmUxGDAW BgNVBAMMDyoud2lraXBlZGlhLm9yZzEcMBoGCSqGSIb3DQEJARYNbm9uZUBub25l LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMP/U8RlcCD6E8AL PT8LLUR9ygyygPCaSmIEC8zXGJung3ykElXFRz/Jc/bu0hxCxi2YDz5IjxBBOpB/ kieG83HsSmZZtR+drZIQ6vOsr/ucvpnB9z4XzKuabNGZ5ZiTSQ9L7Mx8FzvUTq5y /ArIuM+FBeuno/IV8zvwAe/VRa8i0QjFXT9vBBp35aeatdnJ2ds50yKCsHHcjvtr 9/8zPVqqmhl2XFS3Qdqlsprzbgksom67OobJGjaV+fNHNQ0o/rzP//Pl3i7vvaEG 7Ff8tQhEwR9nJUR1T6Z7ln7S6cOr23YozgWVkEJ/dSr6LAopb+cZ88FzW5NszU6i 57HhA7ECAwEAAaAAMA0GCSqGSIb3DQEBBAUAA4IBAQBn8OCVOIx+n0AS6WbEmYDR SspR9xOCoOwYfamB+2Bpmt82R01zJ/kaqzUtZUjaGvQvAaz5lUwoMdaO0X7I5Xfl sllMFDaYoGD4Rru4s8gz2qG/QHWA8uPXzJVAj6X0olbIdLTEqTKsnBj4Zr1AJCNy /YcG4ouLJr140o26MhwBpoCRpPjAgdYMH60BYfnc4/DILxMVqR9xqK1s98d6Ob/+ 3wHFK+S7BRWrJQXcM8veAexXuk9lHQ+FgGfD0eSYGz0kyP26Qa2pLTwumjt+nBPl rfJxaLHwTQ/1988G0H35ED0f9Md5fzoKi5evU1wG5WRxdEUPyt3QUXxdQ69i0C+7 -----END CERTIFICATE REQUEST-----
The above certificate signing request's ASN.1 structure (as parsed by openssl) appears as the following, where the first number is the byte offset, d=depth, hl=header length of the current type, l=length of content:
0:d=0 hl=4 l= 413 cons: SEQUENCE 4:d=1 hl=4 l= 262 cons: SEQUENCE 8:d=2 hl=2 l= 1 prim: INTEGER :00 11:d=2 hl=2 l= 93 cons: SEQUENCE 13:d=3 hl=2 l= 11 cons: SET 15:d=4 hl=2 l= 9 cons: SEQUENCE 17:d=5 hl=2 l= 3 prim: OBJECT :countryName 22:d=5 hl=2 l= 2 prim: PRINTABLESTRING :SG 26:d=3 hl=2 l= 17 cons: SET 28:d=4 hl=2 l= 15 cons: SEQUENCE 30:d=5 hl=2 l= 3 prim: OBJECT :organizationName 35:d=5 hl=2 l= 8 prim: PRINTABLESTRING :M2Crypto 45:d=3 hl=2 l= 18 cons: SET 47:d=4 hl=2 l= 16 cons: SEQUENCE 49:d=5 hl=2 l= 3 prim: OBJECT :commonName 54:d=5 hl=2 l= 9 prim: PRINTABLESTRING :localhost 65:d=3 hl=2 l= 39 cons: SET 67:d=4 hl=2 l= 37 cons: SEQUENCE 69:d=5 hl=2 l= 9 prim: OBJECT :emailAddress 80:d=5 hl=2 l= 24 prim: IA5STRING :firstname.lastname@example.org 106:d=2 hl=3 l= 159 cons: SEQUENCE 109:d=3 hl=2 l= 13 cons: SEQUENCE 111:d=4 hl=2 l= 9 prim: OBJECT :rsaEncryption 122:d=4 hl=2 l= 0 prim: NULL 124:d=3 hl=3 l= 141 prim: BIT STRING 268:d=2 hl=2 l= 0 cons: cont [ 0 ] 270:d=1 hl=2 l= 13 cons: SEQUENCE 272:d=2 hl=2 l= 9 prim: OBJECT :md5WithRSAEncryption 283:d=2 hl=2 l= 0 prim: NULL 285:d=1 hl=3 l= 129 prim: BIT STRING
This was generated by supplying the base64 encoding into the command
openssl asn1parse -in your_request -inform PEM -i where PEM stands for Privacy-enhanced mail and describes the encoding of the ASN.1 Distinguished Encoding Rules in base64.
Microsoft Windows OS versions newer than XP contain certutil.exe. Older OS versions may be able to install certutil.exe as part of another package, e.g. the Windows 2003 Server Service Pack 1 version of adminpak.
Many other programs that are capable of creating a CSR are also capable of decoding it locally into a human readable format.
- M. Nystrom; B. Kaliski (November 2000). PKCS #10: Certification Request Syntax Specification - version 1.7. IETF. RFC 2986. https://tools.ietf.org/html/rfc2986. Retrieved 31 May 2014.
- Nikos Mavrogiannopoulos (5 April 2014). "PKCS #10 certificate requests". GnuTLS.org. Retrieved 31 May 2014.