Skip to content

CA key generation with password protection

CA key generation with password protection refers to the process of creating a Certificate Authority (CA) private key that is secured with a passphrase using the OpenSSL toolkit.^[600-developer__tools__security__CA.md]

The resulting private key file is encrypted, requiring the correct password to be entered before the key can be used for signing certificates or other cryptographic operations.^[600-developer__tools__security__CA.md]

Command

To generate a 2048-bit RSA private key protected by the DES-EDE3-CBC cipher, the following OpenSSL command is used^[600-developer__tools__security__CA.md]:

openssl genrsa -des3 -out ca-des3.key 2048

During execution, the system will prompt the user to enter and verify a passphrase (e.g., 123456) to encrypt the key file^[600-developer__tools__security__CA.md].

Key Characteristics

When a key is generated with the -des3 flag, the output file (e.g., ca-des3.key) contains specific headers indicating the encryption status^[600-developer__tools__security__CA.md]:

  • Proc-Type: Indicates the encryption mode (e.g., 4,ENCRYPTED).
  • DEK-Info: Specifies the encryption algorithm used (e.g., DES-EDE3-CBC) and the initialization vector^[600-developer__tools__security__CA.md].

This encryption ensures that the private key material is stored securely at rest.^[600-developer__tools__security__CA.md]

Comparison

For comparison, a key can be generated without password protection by omitting the encryption flag^[600-developer__tools__security__CA.md]:

openssl genrsa -out ca.key 2048

While this removes the requirement to enter a password during automation or startup, it exposes the private key in plain text within the file^[600-developer__tools__security__CA.md].

Sources

  • 600-developer__tools__security__CA.md