Geek Answers Handbook

What AES / DES encryption should be used for the private key for ssl certificate?

I just bought a special comodo substitution certificate, they asked me to generate csr to activate it.

As I understand it, I need:

  • Generate RSA 2048bit Private Key
  • Generate CSR Based

As I see it, the openssl genrsa accepts different encryption options:

  • -des encrypt the generated key with DES in cbc mode -des3 encrypt the generated key with DES in edb cbc mode (168-bit key)
  • -aes128,
  • -aes192,
  • -aes256

What should i use?

+6
source share
1 answer

The encryption parameter for the openssl genrsa used to specify which algorithm should be used to encrypt your private key (using the password you provided).

CSR (Certificate Signing Request) includes your public key and additional additional information that must be included in the certificate. CSR never includes a private key.

Thus, the choice of private key encryption algorithm is not completely related to CSR. Choose whatever you want. AES and Triple-DES ( -des3 ) -des3 should be preferred; plain DES is generally considered unsafe these days. Also see why AES is safer than DES . But I think that the choice of algorithm in this particular case is not as important as using a strong password and protecting it.

Note. Remember that if you protect your private key with a password, you will be asked to enter a password each time you want to access the private key, for example, when starting a web server. If you forget the password, your private key will actually be lost, and you must create a new key and request a new certificate. You can generate the private key without encryption (without password): openssl genrsa -out filename.key 2048 . You can also remove the password (effectively, keep it unencrypted) at any time using the command as follows: openssl rsa -in encrypted.key -out unencrypted.key . You will need a password for this (you will be asked to enter it).

+10
source

More articles:


All Articles