If you just got an issued SSL certificate and are having a hard time finding the corresponding private key, this article can help you to find that one and only key for your certificate.
Firstly, let’s dive into basics a little. The design of global public key infrastructure, relying on which modern secure negotiation through SSL/TLS is possible, implies that there is always a pair of unique keys – public key is embedded in the SSL certificate and private key is stored on the server and kept secret. When a site visitor fills out a form with personal information and submits it to the server, the information gets encrypted with the public key to protect if from eavesdropping. On the server this information is decrypted by the private key and passed over for further processing. To ensure that nobody else can decrypt the transmitted message, we must use a unique and unforgettable pair of keys. So in a nutshell, one key without another is useless.
Where did this private key come from? The private key is generated simultaneously with the CSR (certificate signing request), containing the domain name, public key and additional contact information. The CSR is to be sent to the certificate authority for validation and signing immediately after the certificate activation. The private key must be kept secret, ideally on the same server the certificate will be installed on.
Why can’t I just generate a new private key for my certificate? Since a public key with the additional information (i.e., domain name and administrative contact information) must be signed by a trusted certificate authority in order to make it applicable and legitimate for securing communication with your server, it wouldn’t make much sense if we could just make up a new private key for an already validated public key. On the other hand, we must be sure that nobody can create a matching private key basing on a public key. Thus, modern cryptosystems make such a task almost impossible. How does this private key look like? Private key is an encoded piece of data, usually a few dozen lines of randomly looking symbols, enclosed with the headers similar to these ones: —–BEGIN RSA PRIVATE KEY—– and —–END RSA PRIVATE KEY—–
Nonetheless, in most cases, this code won’t come into your sight while generating the CSR. It is usually created in the background and silently saved in the server’s filesystem. And obviously, during the SSL certification installation the key should be fetched to the certificate automatically. However, some systems do not have such a kind of behaviour or sometimes we need to install the certificate on another server. These are the examples of the cases when we really need to know the exact location of the private key.
So how can we retrieve it if we do not know / remember its exact location? It depends on a certain server operating system and whether CLI (command line interface) or a web-hosting control panel of a particular type was used for CSR generation. And here comes the main part.
Below you can find tips, examples and pieces of advice that you can consider to follow in order to get a missing puzzle and avoid certificate reissue (i.e., repeating the process of activation and validation from scratch).
Retrieving the private key on different server platforms
Linux operating systems (Apache, Nginx, Lighttpd) Traditionally, private keys on Linux-based operating systems (Ubuntu, Debian, CentOS, RedHat, etc.) are generated with the OpenSSL crypto toolkit and saved into files with the .key or .pem extension. However, since specific extensions are not obligatory for simple text files on Linux systems, the private key code can be put into a file with virtually any name. If you remember the full or partial name of the key file, you can try to get its location by running the ‘find’ command as below: find [search_start_folder] -type f -iname ‘private.key’
- [search_start_folder] parameter indicates the directory to start the search from and through all directories inside it, for example, to search from “root”, the / sign should be specified;
- to do the search by a partial filename, the assumed name of the file should be specified with an asterisk (), for example, the “.key” value allows locating every file with the name ending with “.key”.
- HINT: Very often, the name of the key file resembles the domain name the certificate is issued for, e.g., “nctest.info.key”, “nctest_info.key”, “nctest-info.key” etc. Another way to get the private key file location is to search inside the files by certain patterns: grep -r –exclude-dir=log –exclude-dir=ssh –exclude=history -I -l -e ‘—–BEGIN PRIVATE‘ -e ‘—–BEGIN RSA‘ -e ‘—–BEGIN EC’ [search_start_folder] 2> /dev/null This one-liner command prints out an absolute path to the file, which contains a matching expression (——BEGIN header), for example, “/etc/ssl/private.key”.
Windows operating systems (IIS, Exchange, Small Business server) Windows systems do not allow retrieving the private key in plain text. When an SSL certificate is imported either through MMC or IIS, the matching private key is bound to the certificate automatically, of course, if the certificate is being imported to the same instance the key was generated on. But if we need to get the private key for example, for the certificate installation on another server, there is an option to export the key in a password protected file (PFX or PKCS12 format). To do so, you will need to open MMC Certificates snap-in in the following way: Win+R > mmc.exe > OK > File > Add/Remove Snap-in > Certificates > Add > Computer account > Next > Local computer > Finish > OK Then navigate to Certificate Enrollment Requests > Certificates (if the certificate request was not completed) or Personal > Certificates (if the certificate request was already completed) folder, right-click on the certificate entry and click All Tasks > Export to open the export wizard. As a result, you will receive a .pfx file containing the key.
Mac OS X The default “Keychain” tool in the Server app does not allow accessing the generated private key through the graphic user interface. However, using the command line tools in Terminal, it is possible to navigate to the “/etc/certificates” folder and open the key file, which should be called something like “.key.pem”.
cPanel There are 2 ways to get to the Private key in cPanel:
1. Using SSL/TLS Manager On the cPanel home page, click on “SSL/TLS Manager” and then on the “Private keys” button. On the new screen, you should see the list of the Private keys whenever created in a particular cPanel account. Clicking on the the “View & Edit” button will open the screen presenting the key in both encoded and decoded forms:
2. Using File manager Click on the File manager button from the cPanel home screen and open the window like on the screenshot below. Next, you will need to find the “ssl” folder and then click on the “key” directory inside it. The private keys will appear in the right-side navigation panel. Then the required key file can be either downloaded or opened in plain text:
.png)
WHM In WHM the private keys are stored along with the corresponding CSRs and certificates in “SSL Storage manager”. To get there, you can click “SSL/TLS” on the home screen and then on the “SSL Storage manager”. To open the private key text, you will need to click on the magnifier button in the first column called “Key”.
Plesk After navigating to Domains > domain.com > SSL/TLS certificates, you should see the page similar to the one on the screenshot below. The key sign with the message “Private key part supplied” indicates the presence of the needed key in the system. To open it in plain text, you will need to click on the name of the entry and scroll down until the key code appears on the screen. Alternatively, you can click on the green arrow sign on the right and download the .pem file containing the key, the CSR and the certificate along with the CA bundle, if they were imported already. The .pem file can be opened with any text editor like Notepad:
.png)
Synology NAS DSM In Synology DSM, the private key is downloaded in the archive.zip file on the last step of the CSR generation wizard. It is saved in the server.key file inside the .zip archive and can be opened on a local computer with a text editor:
Webmin The Webmin panel was designed as a graphic user interface on top of the command line tools, although it comes with the File manager (Filemin) which can be used for browsing the file system in order to find the key file, which was created by the OpenSSL command in Command Shell when the CSR was generated. The other way to find the private key in Webmin is to open “Command shell” under the “Others” section and run the “find” or “grep” command.
VestaCP The private key on VestaCP is not saved anywhere throughout the user interface; it is necessary to save the key text into a local file during the CSR generation. However, there is still a chance to find it through SSH. When VestaCP creates a new CSR, the Private key is stored as a temporary file in the “/tmp” directory. The absolute path to the key file might look like “/tmp/tmp.npAnkmWFcu/nctest.info.key”, for example. The main bottleneck here is that the files inside “/tmp” are deleted permanently during each server reboot. To get the location of the key file on your instance, the following command can be invoked: find /tmp -type f -iname ‘domain.com.key’ – “domain.com” should be replaced with the actual domain name the CSR was generated for. Alternatively, the same old “grep” can be used as well: grep -r -I -l -e ‘—–BEGIN PRIVATE’ -e ‘—–BEGIN RSA’ /tmp 2> /dev/null
DirectAdmin In the recent versions of DirectAdmin panel the private key is usually saved in the system and gets pre-fetched in the “Paste a pre-generated certificate and key” section in the SSL Certificates menu. If during the certificate installation you are about to paste the certificate text under the auto-populated private key text but see an empty window, it could mean the CSR code was generated elsewhere or the private key was not added to this window due to a system glitch. In the latter case, it is possible to retrieve the key via SSH. It is normally saved in the following directory: /usr/local/directadmin/data/users//domains/.key , where corresponds to your DirectAdmin username and – to the domain the CSR has been generated for.
Webuzo The “SSL” section in Webuzo is located on the home page. Clicking on the “Private keys” button will lead to the list of the generated keys. To see the key text, the pencil button should be clicked on the right side of the list under the “Option” column:
In conclusion, if none of the above-mentioned tips were helpful and the original private key cannot be retrieved, it is necessary to generate the new CSR / private key pair and reissue the certificate, making sure that the private key is safe this time.