Cyberstudy
PDF p.61 In progress

Certificate Signing Requests

Open PDF at p.61 14 flashcards

Summary

PDF p.61

A certificate signing request (CSR) is a process where a subject generates a key pair and submits a request to a certificate authority (CA) to obtain a digital certificate. The CA verifies the information and, if valid, signs and issues the certificate. Registration with the CA is required to authorize certificate requests.

In plain words

Supplementary — not from your PDF

To get a certificate, you create a key pair, keep the private key safe, and send the CA a certificate signing request (CSR) containing your public key and details. The CA checks you are who you say, then signs and returns the certificate.

Detailed explanation

PDF p.61
  • Registration
    • Process: End users create an account with the CA and become authorized to request certificates.
    • Authorization: Methods vary by CA; can include auto-enrollment (e.g., in a Windows domain) or identity verification tests by third-party CAs.
    • Importance: Ensures certificates are issued only to legitimate users, maintaining the CA's reputation.
  • Certificate Signing Request (CSR)
    • Key Pair Generation: Subject generates private and public asymmetric keys (e.g., RSA or ECC) with a chosen key length.
    • Private Key Protection: Must be kept secure and known only to the subject.
    • CSR Submission: Subject completes a CSR file with information for the certificate, including the public key, and submits it to the CA.
  • CA Review and Issuance
    • Verification: CA checks the validity of the information in the CSR.
    • Web Server Example: Verifies subject name and fully qualified domain name (FQDN), and ensures the CSR was initiated by the responsible person.
    • Certificate Issuance: If valid, the CA signs the certificate and sends it to the subject.

Important terms

taken from the text above
Authorization
Methods vary by CA; can include auto-enrollment (e.g., in a Windows domain) or identity verification tests by third-party CAs.
Key Pair Generation
Subject generates private and public asymmetric keys (e.g., RSA or ECC) with a chosen key length.
Private Key Protection
Must be kept secure and known only to the subject.
CSR Submission
Subject completes a CSR file with information for the certificate, including the public key, and submits it to the CA.
Web Server Example
Verifies subject name and fully qualified domain name (FQDN), and ensures the CSR was initiated by the responsible person.
Certificate Issuance
If valid, the CA signs the certificate and sends it to the subject.
CSR Certificate Signing Request

Examples & real-world scenarios

Supplementary — not from your PDF
  • Generating a CSR on a web server for www.example.com.
  • Windows domain auto-enrollment for internal certificates.
  • The CA confirming you control the domain before issuing.

Scenario

A junior admin emails the private key to the CA along with the CSR 'just in case'. That breaks the key's secrecy: the private key must never leave the server. The key should be regenerated.

Common mistakes

Supplementary — not from your PDF
  • Sending the private key to the CA. Only the public key goes in the CSR.
  • Forgetting that the CA validates the domain or organization before signing.

Practical skills

Supplementary — not from your PDF
  • Describe the steps from key generation to an issued certificate.

What I should remember

Key Points PDF p.61
  • Registration
    • Account Creation: With the CA.
    • Authorization: Varies by CA; can include auto-enrollment or identity verification.
  • Certificate Signing Request (CSR)
    • Key Pair: Private and public keys generated.
    • Private Key: Must be protected.
    • CSR File: Contains public key and other information.
  • CA Review and Issuance
    • Verification: Checks CSR validity.
    • Web Server Example: Verifies subject name and FQDN.
    • Issuance: CA signs and issues the certificate.