Certificate Assistant Generates it's own private key each time

Question

Steve876 Author

Level 1

0 points

Certificate Assistant Generates it's own private key each time

Here's the problem:

1 create a certificate authority... ok.

2.generate a certificate request from that certificate authority... ok... (DONE ON ANOTHER MAC like my laptop...)

3.Send the certificate request to the certificate authority email ok...

4. Receive the certificate request ok... (received on the main desktop machine)

5. Double click on the certificate request... ok it launches the certificate assistant.... and it generates a certificate and mails it back to the other account.

All appears fine.....

EXCEPT that the certificate when imported does not work.... WHY?

WELL

Because a new private key was generated and used instead of simply signing the request....

If of course you send the new public key and the certificate back to the laptop all is well...

But this is NOT how it is supposed to work.

if you get a certificate request you're not supposed to generate a new key pair at the Certificate authority!!! you're just supposed to sign the request

generate the certificate with the given public key and be done with it... but no!!! osx lion insists on generating a new key pair it's self first!!!!

Any help here?

Steve

Mac Pro, Mac OS X (10.7.2)

Posted on Oct 21, 2011 4:52 PM

Reply

Answer 1

Apr 16, 2013 10:26 AM in response to Steve876

Isn’t that special? I thought so… drove me crazy until i found a workaround. When the CA generates signed certificate from the CSR, they need to be mindful of whether their Certificate Assistant generates these spurious keys. If it does:

Delete the spurious user keys and user certificate from the CA’s default (usually: login) keychain. Note that in some cases there will not be a user certificate, if Certificate Assistant presented the duplicate certificate in keychain error. Be sure to check carefully!
If Certificate Assistant made it far enough to create the outgoing email message with the defective certificate, delete this message draft.
Re-run the CSR your user sent in, as if you were doing so for the first time.

In my testing, this workaround works 100% of the time: the second time the CSR runs on the CA’s system, the CA’s Certificate Assistant properly signs the user’s certificate and does not make any spurious keys on the CA’s system.

BTW i have seen this happen with Certificate Assistant 2.0/10.5.8 Leopard, CA 3.0/10.6.8 Snow Leopard, and CA 4.4/10.7.5 Lion. I have not yet seen it with CA 5.0/10.8.3 Mountain Lion, though given the intermittent nature of this bug, my confidence is low that it is truly fixed.

I’ve spent the last few years spending waaaaaaay too much time testing and documenting Apple’s OS X and Mail S/MIME implementation, and recently put up web pages with my findings, including this workaround. Hopefully the information will help some folks.

))Sonic((

Reply

Answer 2

frodesto

Level 1

4 points

Nov 23, 2013 1:58 PM in response to Sonic Purity

I'm having the same problem under OS X 10.9 Mavericks. Deleting the spurious certificates and keys does not seem to work, they appear again after resubmitting the CSR.

Reply