Home / server / Questions / 294147
Accepted
Alexander
Asked: 2011-07-27 02:27:31 +0800 CST

SSL troubles - Generate .key from .crt? (AlphaSSL)

  • 772

This is greatly troubling me,

I have generated a .csr and .key file to send to dynadot (which sends that to AlphaSSL) with this command:

openssl req -out foo.com.csr -new -newkey rsa:2048 -nodes -keyout foo.com.key

It had asked me for confirmation and I received apparently an intermediate chain certificate, however I just placed it in foo.com.crt and it worked fine on my domain.

Contrary to what the purchasing pages had stated, SSL only works on (domain.com) and not (www.domain.com) and I had used domain.com for my common name when generating the original signing request.

I thought this was due to me not using the intermediate chaining, so I had foolishly overwritten the .csr and .key to try to install the GlobalSign root cert before the AlphaSSL one provided to me by dynadot in the same .csr file, however it gives me a warning about a mismatch with my .key file now (I am using nginx)

I had tried to reproduce my steps and settings, however I cannot get the (fresh crt, just what was given to me by dynadot) and .key that I regenerated with the same settings - it just mismatches.

Is it possible to re-request the csr? or generate the private .key from the .csr I was given?

I would rather not spend another chunk of money, and I've no actual AlphaSSL account so I am not sure I can really ask for support or redo the signing.

If you could provide any advice or help I would appreciate it.

keys certificate-authority ssl-certificate openssl

3 Answers

  1. Best Answer

    You can't do any of those. Just issue a revoke request and get a new cert. If you loose your private key - bang, you're gone. That's the whole point of it.

    • 7

  2. Like @sh1ny already said: if your private key is gone, you're* out of options. Have the certificate revoked and get a new one.

    Perhaps this time from somewhere that doesn't gauge you on simple things like automatically signed basic TLS certificates? ;-)

    *) You should be. If they can help you out in another way than revoking your certificate or maybe signing another CSR free of charge, then you should avoid them anyway!

    • 0

  3. If you have a root login to a server you have generated it on, and if you did it via whm/cpanel

    try looking for a key at /var/cpanel/ssl/system

    they might have been there until the system cleanup...

    Just look at the file dates, because names might be random.

    • 0