Take the tour ×

Suppose I have 2 files: an RSA key file client.key and a certification file client.crt.

I have created them without pass-phrase and now I have encrypted client.key file with pass-phrase by command:

openssl rsa -des3 -in client.key -out client-enc.key

Now I want to re-create/update client.crt file with client-enc.key. How can I do that?

share|improve this question
add comment

2 Answers

A certificate contains a public key and signatures of this public key. This is not confidential information; sometimes you might not want to reveal it for privacy, but this isn't a common enough concern that there would be a specific certificate encryption format. If you want to encrypt the certificate, use your favorite encryption tool, e.g. PGP/GPG.

Is your concern that you've changed the key? If so, you're confused as to what the key and certificate represent, and since this is a rather important matter, I advise reading more on the topic.

  • If you've only put a password on the key file, that's something you did to the key file, i.e. to the medium in which you stored the key. The encryption of the private key file is an independent operation, not directly related to the fact that the file contains a private key. But because protecting a private key for confidentiality is a very common requirement, there is a standard format and an openssl command for doing that. The key is the same, but this particular copy of the key now requires a password to be read.
  • If you had actually changed the private key (which, from your description, you haven't!), you would have to regenerate the certificate from scratch. The fact that a public key only corresponds to one particular private key is fundamental in public-key cryptography: the public key represents your identity, and (knowledge of) the private key is the way you prove your identity.
share|improve this answer
I was look inside the .crt file as I see a block of "-----BEGIN CERTIFICATE-----" so I think it has embedded rsa key inside but seen I was wrong :P –  Uoc Nguyen Jun 15 '11 at 10:18
@Uoc: It has a certificate, which contains a public RSA key. –  Gilles Jun 15 '11 at 15:33
Yes, I think so. –  Uoc Nguyen Jun 15 '11 at 17:42
add comment

I don't believe you need to. The .crt file only contains the public half of the key, it does not contain a copy of the private key, and you haven't changed the content of the private key anyway — you've just wrapped it inside a symmetric encryption layer (decrypted by the passphrase). Why do you believe you need to update the certificate?

share|improve this answer
Yes, I think so! –  Uoc Nguyen Jun 15 '11 at 10:19
The certificate file contains the whole public key, not just a fingerprint of it! (Plus a signature that guarantees the authenticity, that's actually why it's called a certificate and you request it from a certification authority) –  Riccardo Murri Jun 15 '11 at 21:50
thanks for the correction, edited accordingly. –  jmtd Jun 20 '11 at 9:39
add comment

Your Answer


