Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When creating a CSR with openSSL it asks me:

Enter PEM pass phrase:

After that it asks:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:

I read that pem pass phrase is for encrypting the key file. And any service(like apache) using the key file will ask for pem pass phrase when rebooting the service. Then what is challenge password?

share|improve this question
up vote 11 down vote accepted

This adds the challengePassword attribute to the certificate request, described in PKCS#9 section 5.4.1:

5.4.1 Challenge password

The challengePassword attribute type specifies a password by which an entity may request certificate revocation. The interpretation of challenge passwords is intended to be specified by certificate issuers etc; no particular interpretation is required.

This attribute is part of the request and will not be present in the final certificate. In most cases, you can just leave this attribute empty – most CAs ignore it.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .