<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.StileMessaggioDiPostaElettronica18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="IT" link="blue" vlink="purple" style="word-wrap: break-word;-webkit-nbsp-mode: space;line-break:after-white-space">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Yes Paul, you are right. Real CA must never accept CSR without verifying the signature.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#17365D">Francesco Petruzzi<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><i><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#17365D"><o:p> </o:p></span></i></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#17365D">Information Security Manager<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#17365D">Innovery SpA<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#17365D">Via Farini, 81 – 20159 Milano<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#17365D">Cell. +39 320 170 4978<o:p></o:p></span></b></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">Da:</span></b><span style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""> Paul Yang [mailto:kaishen.yy@alipay.com]
<br>
<b>Inviato:</b> giovedì 12 settembre 2019 10:46<br>
<b>A:</b> Francesco Petruzzi<br>
<b>Cc:</b> openssl-users@openssl.org<br>
<b>Oggetto:</b> Re: CSR with only public key<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Dare any CA proceed to sign a CSR without verifying the signature…<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Maybe there are scenarios we are not aware about...<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal">On Sep 12, 2019, at 4:41 PM, Francesco Petruzzi <<a href="mailto:francesco.petruzzi@innovery.net">francesco.petruzzi@innovery.net</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Sign request with a fake private key and hope the client do not require signature verification.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Regards</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Francesco Petruzzi</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
</div>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">Da:</span></b><span class="apple-converted-space"><span style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""> </span></span><span style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">openssl-users
[<a href="mailto:openssl-users-bounces@openssl.org"><span style="color:purple">mailto:openssl-users-bounces@openssl.org</span></a>]<span class="apple-converted-space"> </span><b>Per conto di<span class="apple-converted-space"> </span></b>Paul Yang via openssl-users<br>
<b>Inviato:</b><span class="apple-converted-space"> </span>giovedì 12 settembre 2019 09:51<br>
<b>A:</b><span class="apple-converted-space"> </span>Bharathi Prasad<br>
<b>Cc:</b><span class="apple-converted-space"> </span>Openssl Users<br>
<b>Oggetto:</b><span class="apple-converted-space"> </span>Re: CSR with only public key</span><o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">How could you create the CSR with only public key?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">On Sep 12, 2019, at 3:50 PM, Bharathi Prasad <<a href="mailto:barati.j.prasad@gmail.com"><span style="color:purple">barati.j.prasad@gmail.com</span></a>> wrote:<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal">Hi,<br>
I have the public key of the client but not the private key. I am required<br>
to generate a CSR with only public key. I understand private key is required<br>
for Proof of Possession. However, as per my requirement I am supposed to<br>
create CSR only with public key and my CA would create a certificate.<span class="apple-converted-space"> </span><br>
<br>
I was able to create a CSR with CX509CertificateRequestCertificate and<br>
CX509Enrollment classes using the available public key. When I try to read<br>
the contents the of CSR in openssl (i used this command: openssl req -in<br>
client.csr -noout -text) i get "unable to load X509 request".<span class="apple-converted-space"> </span><br>
<br>
Is this happening because the CSR does not contain the signature of private<br>
key or the CSR is faulty.<br>
<br>
Kindly help me.<br>
<br>
Regards,<br>
Bharathi<br>
<br>
<br>
<br>
--<br>
Sent from:<span class="apple-converted-space"> </span><a href="http://openssl.6102.n7.nabble.com/OpenSSL-User-f3.html"><span style="color:purple">http://openssl.6102.n7.nabble.com/OpenSSL-User-f3.html</span></a><o:p></o:p></p>
</div>
</div>
</div>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><br>
Regards,</span><o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""> </span><o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">Paul Yang</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><br>
Regards,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">Paul Yang<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>