Before creating a CSR for an
X.509 certificate, the applicant generates a
key pair, keeping the
private key of that pair secret, e.g.: The CSR contains information identifying the applicant (such as a
distinguished name), the
public key chosen by the applicant, and possibly further information. When using the PKCS #10 format, the request must be self-signed using the applicant's
private key, which provides proof of possession (POP) of the private key but limits the use of this format to keys that can be used for (some form of) signing. The CSR must be accompanied by a proof of origin (i.e., proof of identity of the applicant), which is required for security reasons by the certificate authority. The certificate authority may contact the applicant for further information. Typical information required in a CSR (sample column from
sample X.509 certificate). Note that there are often alternatives for the Distinguished Names (DN), the preferred value is listed. This OpenSSL sample command line uses the details as listed in the table above to create a CSR in PKCS #10 format: The CSR is typically sent to a
Registration Authority (RA), which checks the CSR contents and authenticates the applicant. On success the CSR is forwarded to a
Certificate Authority (CA), which produces the X.509 public-key certificate, digitally signing it using the CA private key, and sends the new certificate to the applicant. == Structure of a PKCS #10 CSR ==