Extra attributes in a certificate signing request When creating a certificate signing request, there is a part where openssl says "Please enter the following extra attributes to be sent with your certificate request". One of these is a challenge password.

Under what circumstances will this password be needed?
From RFC 2985:


  The challengePassword attribute type specifies a password by which an
  entity may request certificate revocation.  The interpretation of
  challenge passwords is intended to be specified by certificate issuers
  etc; no particular interpretation is required.


This has also come up over at Information Security Stackexchange with the TL;DR being it's the password you set during the certificate request to share a revocation password with the CA, this however is rarely to never used in practice, because CAs nowadays have "normal" log-in mechanisms just like any other website and use them control revocation.