ssl certificate- get private key from csr

Question

Is it possible to export private key from CERTIFICATE SIGNING REQUEST ?

I have a CSR file and some CRT files. Now I have to install this certificate . How do I do it or do I need some other files in order to install this certificate ?

Answer 1

No you cannot export the private key from CSR because the CSR does not contain any private key.

You need another file that has a private key and if you have that you won't need the CSR to extract the private key.

Answer 2

You create CSR from a private key not other way around.

In general the process goes like

1. You create private key
2. You create CSR Hand CSR to Certificate Authority aka CA
3. CA will give you a Certificate
4. you are good to go with you private key and with certificate depending upon client eg PHP Curl is fine with it
5. You may also combine your private key and Certificate using PKCS12 format depending upon your client requirements.

Answer 3

First comes the private key generated by you. openssl is a great utility for this.

Then the public key can be generated from the private key, or a Certificate Signing Request file can be generated which contains the public key in addition to extra information about your company and your site.

That CSR is pasted (using the Godaddy or Digicert methods) into a certificate request form on their respective sites. There is a verification process which may happen automatically or by email.

Then they'll generate a cert which you can use -- the public key is part of the cert.

So notice that you started off with a generated public private key pair, and ended with a cert private key pair.

If you're talking about a 'client' (general rule, this process can go back and forth), in general it will use just the cert, which is sent from the server during TLS (ahem, was SSL) negotiations. Or a utility program will use a cert when talking to a 'server' that is paired with it. The server is the one that will decrypt with the private key what was encrypted using the public key embedded in the cert.

So if all you have is a cert, in general you are talking about a client that knows which server it is going to go to.

But usually you are talking about a server, in which case the private key is probably already installed, and all you are doing is updating the cert. So if we are talking about a webserver, there are going to be configuration files which will point you to where the 'old' cert is that you are replacing. You'll also see where the key is, but that wouldn't need to be replaced unless you started the process by generating a new key. If so, then you'd also replace the old key with the new key.

Answer 4

I ended up in the same situation when I was given a new certificate from a third party for an existing CSR.

The initial CSR was complete and certificate was installed in Windows environment. When I tried to import the new certificate it was imported without its private key. This link was very helpful:

https://docs.microsoft.com/en-us/troubleshoot/iis/assign-certificate-private-key

Basically when creating a CSR (from IIS etc.) Windows stores the private key internally. When importing the certificate to the same machine, Windows automatically signs it with the private key.

When you import it for a second time. You have to use the command:

certutil -repairstore my "SerialNumber"

Where Serial number is the imported certificate's serial number