Let's face it,
OpenSSL is the number one toolkit for any PKI expert when it comes to dissecting and manipulating files such as
CSRs, certificates,
PKCS#12 keystores, asymmetric keys etc. We use it all the time when developing
EJBCA, Open Source PKI.
Using openssl is not always the easiest task in the world, but there are a number of commands that I find myself using over and over again. So much that I can almost type them in my sleep.
Parsing certificates
Reading X.509 certificates in PEM format:
openssl x509 -in cert.pem -text
Reading X.509 certificates in DER format:
openssl x509 -inform DER -in cert.der -text
Converting X.509 certificates from DER to PEM:
openssl x509 -inform DER -in cert.der -outform PEM -out cert.pem
You can also add parameters to only output specific fields, like certificate serial number, public key etc. I rarely use those though, I just dump the cert and look at the whole thing.
Parsing certificate signing requests (CSRs)
Reading a CSR in PEM format:
openssl req -in req.pem -text
Reading a CSR in DER format:
openssl req -inform DER -in req.pem -text
Converting a CSR from DER to PEM:
openssl req -inform DER -in req.der -outform PEM -out req.pem
Parsing pure ASN.1
Sometimes you really want to see the nitty gritty details of a certificate or CSR, to find out what encoding is used in the DN, how the extensions look, what order fields actually are in the file etc.
openssl asn1parse -in cert.pem
add the dump parameter to dump the (unknown) contents of sequences:
openssl asn1parse -in cert.pem -dump
Generating certificate signing requests (CSRs)
To generate a new key pair and a certificate request, for example for getting a certificate for an apache server:
openssl req -out csr.csr -new -newkey rsa:2048 -nodes -keyout private.key
Check the private key:
openssl rsa -in cesecore2013.key -check
When generating CSRs you can add a lot of options to put in the CSR, like Subject Alternative names, certificate purposes, OCSP URLs etc. When creating CSRs to be sent to a CA this is normally not needed. The CA will populate all the fields for you, and normally ignore any additional fields that you specify (a real CA have no reason to trust arbitrary input from you). If you are generating your own self-signed certificates however, this may be of interest.
Kevin McArthur has written a nice
blog post how to work with OpenSSL to create certificates and CSRs. It's a bit outdated, but Kevin may update it.
Parsing PKCS#12 keystores
Reading a PKCS#12 file, giving output with encrypted private key in PEM format:
openssl pkcs12 -in superadmin.p12
Reading a PKCS#12 file, output with unencrypted private key:
openssl pkcs12 -in superadmin.p12 -nodes
The following commands are useful for splitting a PKCS#12 file up into PEM components (for example for an apache server or for manual sign/verify operations):
Reading a PKCS#12 file, outputing only the certificate to a file:
openssl pkcs12 -in server.p12 -nodes -nokeys -clcerts -out server.pem
Reading a PKCS#12 file, outputing only the private key to a file:
openssl pkcs12 -in server.p12 -nodes -nocerts -out server.priv
Reading the cert, extracting the public key in RSA format:
openssl x509 -in server.pem -pubkey -noout > server.pub
Signing and verifying large files
Signing of large files are done by making a digest (hash) of the file and then signing the hash:
openssl dgst -sign superadmin.key -sha1 file.txt > file.txt.sign
Verification of a file is done by verifying the signed hash (extracting the original hash) and comparing that to a newly calculated hash of the file:
openssl dgst -verify superadmin.pubkey -signature file.txt.sign -sha1 file.txt
See also
Code signing over in the EJBCA Admin Guide.
Cmpforopenssl
I have previously written about
cmpforopenssl. This is a great tool for using the CMP protocol.
You can read more about cmpforopenssl and EJBCA in the
EJBCA Admin Guide.
OCSP
A popular openssl command for me is the OCSP request command. I use this to test OCSP responders all the time:
openssl ocsp -issuer Test-CA.pem -CAfile Test-CA.pem -cert Test.pem -req_text -url http://localhost:8080/ejbca/publicweb/status/ocsp
The tricky thing here is if you have an external OCSP responder, i.e. not requesting directly from the CA, then you must have the right combination of -CAfile and chain commands in order for the verification to succeed without having openssl claim that issuer is not trusted.
The above command is perfect if you are requesting directly from the CA...
TLS client
You can test TLS/SSL servers using OpenSSL's s_client command. This is great for debugging TLS connections. It will show you the certificates used by the server and the accepted CA certificates sent by the server when asking for client certificate authentication. It can also be used to see the cipher suites negotiated.
openssl s_client -debug -msg -connect servername:443 > debug-log.txt < /dev/null
Converting between JKS and PKCS#12 (not using openssl)
Another old popular
blog post I wrote was about converting between JKS and P12 using simple java commands, keytool.
Remove MS CSP information from a PKCS12/PFX
George L wrote an interesting comment on
LinkedIn.
It's about MS adding CSP information when exporting a PKCS12 files, and this can cause errors when importing it into other versions of Windows. He provided a cool script that removes this information, using openssl.
----------------- removeCSP.bat --------------
@echo off
rem make sure you've got openssl and grep either in your path or in the same directory as the batch file
set /p pass=Please enter keystore password:
cd /d "%~dp0"
openssl pkcs12 -in "%~f1" -nodes -passin pass:"%pass%" | grep -v
Microsoft | openssl pkcs12 -export -out "%~f1".new.pfx -passout
pass:"%pass%"
echo Conversion complete.
pause
------------------ removeCSP.bat --------------
Posts
