- Generate Self Signed Certificate Openssl
- Create P12 From Crt And Key Openssl
- Openssl Create Pkcs12 From Crt And Key
- Generate Crt Certificate Openssl
- Create Pkcs12 From Crt And Key Openssl
- Openssl Generate Rsa Key Pair
While Encrypting a File with a Password from the Command Line using OpenSSLis very useful in its own right, the real power of the OpenSSL library is itsability to support the use of public key cryptograph for encrypting orvalidating data in an unattended manner (where the password is not required toencrypt) is done with public keys.
In this case, you can generate a new self-signed certificate that represents a Common Name your application can validate. This topic tells you how to generate self-signed SSL certificate requests using the OpenSSL toolkit to enable HTTPS connections.
The Commands to Run
Generate a 2048 bit RSA Key
You can generate a public and private RSA key pair like this:
openssl genrsa -des3 -out private.pem 2048
That generates a 2048-bit RSA key pair, encrypts them with a password you provideand writes them to a file. You need to next extract the public key file. You willuse this, for instance, on your web server to encrypt content so that it canonly be read with the private key.
Export the RSA Public Key to a File
This is a command that is
openssl rsa -in private.pem -outform PEM -pubout -out public.pem
The -pubout flag is really important. Be sure to include it.
Next open the public.pem and ensure that it starts with-----BEGIN PUBLIC KEY-----. This is how you know that this file is thepublic key of the pair and not a private key.
To check the file from the command line you can use the less command, like this:
less public.pem
Do Not Run This, it Exports the Private Key
A previous version of the post gave this example in error.
openssl rsa -in private.pem -out private_unencrypted.pem -outform PEM
The error is that the -pubout was dropped from the end of the command.That changes the meaning of the command from that of exporting the public keyto exporting the private key outside of its encrypted wrapper. Inspecting theoutput file, in this case private_unencrypted.pem clearly shows that the keyis a RSA private key as it starts with -----BEGIN RSA PRIVATE KEY-----.
Visually Inspect Your Key Files
It is important to visually inspect you private and public key files to makesure that they are what you expect. OpenSSL will clearly explain the nature ofthe key block with a -----BEGIN RSA PRIVATE KEY----- or -----BEGIN PUBLIC KEY-----.
You can use less to inspect each of your two files in turn:
less private.pemto verify that it starts with a-----BEGIN RSA PRIVATE KEY-----less public.pemto verify that it starts with a-----BEGIN PUBLIC KEY-----
The next section shows a full example of what each key file should look like.
The Generated Key Files
Generate Self Signed Certificate Openssl
The generated files are base64-encoded encryption keys in plain text format.If you select a password for your private key, its file will be encrypted withyour password. Be sure to remember this password or the key pair becomes useless.
The private.pem file looks something like this:
The public key, public.pem, file looks like:
Protecting Your Keys
Depending on the nature of the information you will protect, it’s important tokeep the private key backed up and secret. The public key can be distributedanywhere or embedded in your web application scripts, such as in your PHP,Ruby, or other scripts. Again, backup your keys!
Remember, if the key goes away the data encrypted to it is gone. Keeping aprinted copy of the key material in a sealed envelope in a bank safety depositbox is a good way to protect important keys against loss due to fire or harddrive failure.
Oh, and one last thing.
If you, dear reader, were planning any funny business with the private key that I have just published here. Know that they were made especially for this series of blog posts. I do not use them for anything else.
Found an issue?
Rietta plans, develops, and maintains applications.
Learn more about our services or drop us your email and we'll e-mail you back.
Other Blog Articles Published by Rietta.com
Generate a .jks keystore using .key and .crt files
Generate a .jks keystore using .key and .crt files :
Notes :
x509 standard assumes a strict hierarchical system of certificate authorities (CAs) for issuing the certificates.
Structure of a certificate :
The structure of an X.509 v3 digital certificate is as follows:
.
Certificate
Version
Serial Number
Algorithm ID
Issuer
Validity
Not Before
Not After
Subject
Subject Public Key Info
Public Key Algorithm
Subject Public Key
Issuer Unique Identifier (Optional)
Subject Unique Identifier (Optional)
Extensions (Optional)
…
Certificate Signature Algorithm
Certificate Signature
Issuer and subject unique identifiers were introduced in Version 2, Extensions in Version 3. Nevertheless, the Serial number must be unique for each certificate issued by a specific CA
Certificate filename extensions :
Common filename extensions for X.509 certificates are:
.pem – (Privacy Enhanced Mail) Base64 encoded DER certificate, enclosed between “—–BEGIN CERTIFICATE—–” and “—–END CERTIFICATE—–”
.cer, .crt, .der – usually in binary DER form, but Base64-encoded certificates are common too (see .pem above)
.p7b, .p7c – PKCS#7 SignedData structure without data, just certificate(s) or CRL(s)
Create P12 From Crt And Key Openssl
.p12 – PKCS#12, may contain certificate(s) (public) and private keys (password protected)
.pfx – PFX, predecessor of PKCS#12 (usually contains data in PKCS#12 format, e.g, with PFX files generated in IIS)
PKCS#7 is a standard for signing or encrypting (officially called “enveloping”) data. Since the certificate is needed to verify signed data, it is possible to include them in the SignedData structure. A .P7C file is a degenerated SignedData structure, without any data to sign.
PKCS#12 evolved from the PFX (Personal inFormation eXchange) standard and is used to exchange public and private objects in a single file.
Steps :
Tools like in F5 load balancers generate .crt and .key files ( they basically use openssl ).
Here .crt is the signed certificate from a CA and key contains the private key.
These keys and certificates are in PEM format.
– Open both the files in a notepad and copy the contents in it to a new notepad file and save it with extension .pem
– Now we need to convert this .pem to .des
Note : DES is a binary format and non readable whereas PEM are in human readable form.
Note : Make sure OpenSSL is installed ( You can download it from : http://www.slproweb.com/products/Win32OpenSSL.html )
– You can use the following command to convert PEM to DER format.
Openssl Create Pkcs12 From Crt And Key
Command : openssl pkcs8 -topk8 -nocrypt -in key.pem -inform PEM -out key.der -outform DER ( this command will convert the key file (PEM format) containing private key to DER format )
Command : openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER ( This command converts the signed certificate (PEM format) to DER format ).
– Now we need to add the signed certificate and the private key into the keystore.
Keytool does not let you import an existing private key for which you already have a certificate.
– Download and compile the java code from the link below :
Generate Crt Certificate Openssl
Link : http://www.agentbob.info/agentbob/80.html ( ImportKey.java )
Command : javac ImportKey.java
The above code will add the private key and the certificate into a .jks keystore.
Default name of the keystore that will be created : keystore.ImportKey ( you can edit the code and change it to identity.jks )
Default password/passphrase for the private key : importkey ( you can edit the code to make changes in it accordingly )
Create Pkcs12 From Crt And Key Openssl
Default alias name given to this key would be : importkey
Once you have the .class file run the command below to generate the keystore ( i.e identity.jks ) :
Command : Â java ImportKey key.der cert.der ( Note the first argument is the key file and the second is the cerificate (both in DER format) )
Note : The keystore is not created in the same directory. You can find it in the root folder ( Eg : C:Documents and SettingsCoolDragon… )
– Now import your rootca.crt file into this keystore to complete the chaining of certificates
Command : keytool -import -file rootca.crt -alias -trustcacerts -keystore keystore.ImportKey -storepass importkey
– Now list the certificates of the keystore to check if the chaining is fine :
Command : keytool -v -list -keystore keystore.ImportKey -storepass importkey
Openssl Generate Rsa Key Pair
Identity.jks file is now ready 🙂