I have a private DSA key in PEM format that contains the following:

Proc-Type: 4,ENCRYPTED


and I need to produce a public certificate from this private key.

I can convert it to a public key in the format:

-----END PUBLIC KEY-----

using openssl dsa -in private-key.pem -pubout but can't seem to get a certificate from it. My understanding is that the private key contains the certificate and additional information, therefore I should be able to extract it somehow.

The format I need is


Am I fundamentally misunderstanding something?

migrated from crypto.stackexchange.com Oct 1 at 13:52

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • I think this is more into superuser? – kelalaka Oct 1 at 13:21
  • 1
    @kelalaka I was tied between the two to be honest. If the mods think it's better suited over on superuser then that's fine by me :) – Prisoner Oct 1 at 13:23

My understanding is that the private key contains the certificate and additional information...

Sorry, that's not correct.

In asymmetric key files a private key contains the public key (or, for DSA, enough data to rebuild the public key), but a certificate is a completely different beast altogether.

A certificate is A) a public key, B) some information about the owner of the public key, C) some information about who is attesting this information is true (enough), D) the signature from (C).

Once you have a certificate you can only use it in things like TLS when you also have the private key, but you need both parts, neither the "BEGIN CERTIFICATE" portion nor the "BEGIN PRIVATE KEY" portion can produce the other. (Well, with enough (quantum) computing power you could recover the private key from a cert, but that's considered "infeasibly hard").

I need to produce a public certificate from this private key.

You can produce a self-signed cert from the key via a command like

openssl req -new -x509 -key private.key -out new.cer

If you need it to be a trusted certificate, you'd create a certification request ("certificate signing request", CSR) and submit it to a CA.

openssl req -new -key private.key -out new.csr
  • For completeness, if you get a cert from a 'real' CA (e.g. Digicert, GoDaddy, LetsEncrypt) it will almost always need one or sometimes a few 'chain' cert(s) to be validated, and some applications notably TLS (and HTTPS) require the prover (server) to send such chain cert(s). As a result there are hundreds of Qs across several Stacks on the themes of: What does 'missing chain cert(s)' mean? What are chain certs? How do I find/get my chain cert(s)? How do I configure this server with my chain cert(s)? – dave_thompson_085 Oct 2 at 1:05
  • thanks @bartonjs - I clearly got my information about private keys and certs mixed up. thanks for the clarity. – Prisoner Oct 3 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.