3

I'm a bit confused by this command for generating a self-signed certificate from an otherwise clear tutorial on OpenSSL:

openssl req \
  -x509 -nodes -days 365 -sha256 \
  -newkey rsa:2048 -keyout mycert.pem -out mycert.pem

I understand this generates a request for a self-signed x509 certificate, and not a certificate request to be signed by a CA, but the private key is in the generated certificate file and sounds dodgy to me since the private key shouldn't be sent with the certificate.

Is this an error or how this is supposed to work?

JW0914
  • 9,096

1 Answers1

2

I understand this generates a request for a self-signed x509 certificate, and not a certificate request to be signed by a CA, but the private key is in the generated certificate file and sounds dodgy to me since the private key shouldn't be sent with the certificate.

It will not be sent with the certificate.

Certificates and files are not the same thing. The TLS software never sends the actual file anywhere as-is – it reads the file, interprets its contents, and loads the data that it wants to load. When you have a PEM-formatted file with multiple items, the program easily knows when one item ends and another begins.

In this case, the program using your .pem file will load one "certificate" object and one "private key" object from it, after which point the original source is no longer relevant – it could've been a single .pem file, two separate .pem files, a DER .crt file, a PKCS#12 .pfx file, or not even a file in the first place. The program only cares about the actual certificates that are now in memory – if it needs to send a certificate it'll send only that.

grawity
  • 501,077