Use this command to create a password-protected, 2048-bit private key (domain.key):<\/p>\n\n\n\n
openssl genrsa -des3 -out domain.key 2048<\/code><\/pre>\n\n\n\nEnter a password when prompted to complete the process.<\/p>\n\n\n\n
Verify a Private Key<\/h3>\n\n\n\n
Use this command to check that a private key (domain.key) is a valid key:<\/p>\n\n\n\n
openssl rsa -check -in domain.key<\/code><\/pre>\n\n\n\nIf your private key is encrypted, you will be prompted for its pass phrase. Upon success, the unencrypted key will be output on the terminal.<\/p>\n\n\n\n
Verify a Private Key Matches a Certificate and CSR<\/h3>\n\n\n\n
Use these commands to verify if a private key (domain.key) matches a certificate (domain.crt) and CSR (domain.csr):<\/p>\n\n\n\n
openssl rsa -noout -modulus -in domain.key | openssl md5\nopenssl x509 -noout -modulus -in domain.crt | openssl md5\nopenssl req -noout -modulus -in domain.csr | openssl md5<\/code><\/pre>\n\n\n\nIf the output of each command is identical there is an extremely high probability that the private key, certificate, and CSR are related.<\/p>\n\n\n\n
Encrypt a Private Key<\/h3>\n\n\n\n
This takes an unencrypted private key (unencrypted.key) and outputs an encrypted version of it (encrypted.key):<\/p>\n\n\n\n
openssl rsa -des3 \\\n -in unencrypted.key \\\n -out encrypted.key<\/code><\/pre>\n\n\n\nEnter your desired pass phrase, to encrypt the private key with.<\/p>\n\n\n\n
Decrypt a Private Key<\/h3>\n\n\n\n
This takes an encrypted private key (encrypted.key) and outputs a decrypted version of it (decrypted.key):<\/p>\n\n\n\n
openssl rsa \\\n -in encrypted.key \\\n -out decrypted.key<\/code><\/pre>\n\n\n\nEnter the pass phrase for the encrypted key when prompted.<\/p>\n\n\n\n
Convert Certificate Formats<\/h2>\n\n\n\n
All of the certificates that we have been working with have been X.509 certificates that are ASCII PEM encoded. There are a variety of other certificate encoding and container types; some applications prefer certain formats over others. Also, many of these formats can contain multiple items, such as a private key, certificate, and CA certificate, in a single file.<\/p>\n\n\n\n
OpenSSL can be used to convert certificates to and from a large variety of these formats. This section will cover a some of the possible conversions.<\/p>\n\n\n\n
Convert PEM to DER<\/h3>\n\n\n\n
Use this command if you want to convert a PEM-encoded certificate (domain.crt) to a DER-encoded certificate (domain.der), a binary format:<\/p>\n\n\n\n
openssl x509 \\\n -in domain.crt \\\n -outform der -out domain.der<\/code><\/pre>\n\n\n\nThe DER format is typically used with Java.<\/p>\n\n\n\n
Convert DER to PEM<\/h3>\n\n\n\n
Use this command if you want to convert a DER-encoded certificate (domain.der) to a PEM-encoded certificate (domain.crt):<\/p>\n\n\n\n
openssl x509 \\\n -inform der -in domain.der \\\n -out domain.crt<\/code><\/pre>\n\n\n\nConvert PEM to PKCS7<\/h3>\n\n\n\n
Use this command if you want to add PEM certificates (domain.crt and ca-chain.crt) to a PKCS7 file (domain.p7b):<\/p>\n\n\n\n
openssl crl2pkcs7 -nocrl \\\n -certfile domain.crt \\\n -certfile ca-chain.crt \\\n -out domain.p7b<\/code><\/pre>\n\n\n\nNote that you can use one or more -certfile options to specify which certificates to add to the PKCS7 file.<\/p>\n\n\n\n
PKCS7 files, also known as P7B, are typically used in Java Keystores and Microsoft IIS (Windows). They are ASCII files which can contain certificates and CA certificates.<\/p>\n\n\n\n
Convert PKCS7 to PEM<\/h3>\n\n\n\n
Use this command if you want to convert a PKCS7 file (domain.p7b) to a PEM file:<\/p>\n\n\n\n
openssl pkcs7 \\\n -in domain.p7b \\\n -print_certs -out domain.crt<\/code><\/pre>\n\n\n\nNote that if your PKCS7 file has multiple items in it (e.g. a certificate and a CA intermediate certificate), the PEM file that is created will contain all of the items in it.<\/p>\n\n\n\n
Convert PEM to PKCS12<\/h3>\n\n\n\n
Use this command if you want to take a private key (domain.key) and a certificate (domain.crt), and combine them into a PKCS12 file (domain.pfx):<\/p>\n\n\n\n
openssl pkcs12 \\\n -inkey domain.key \\\n -in domain.crt \\\n -export -out domain.pfx<\/code><\/pre>\n\n\n\nYou will be prompted for export passwords, which you may leave blank. Note that you may add a chain of certificates to the PKCS12 file by concatenating the certificates together in a single PEM file (domain.crt) in this case.<\/p>\n\n\n\n
PKCS12 files, also known as PFX files, are typically used for importing and exporting certificate chains in Microsoft IIS (Windows).<\/p>\n\n\n\n
Convert PKCS12 to PEM<\/h3>\n\n\n\n
Use this command if you want to convert a PKCS12 file (domain.pfx) and convert it to PEM format (domain.combined.crt):<\/p>\n\n\n\n
openssl pkcs12 \\\n -in domain.pfx \\\n -nodes -out domain.combined.crt<\/code><\/pre>\n\n\n\nNote that if your PKCS12 file has multiple items in it (e.g. a certificate and private key), the PEM file that is created will contain all of the items in it.<\/p>\n\n\n\n
Generating CSRs<\/h2>\n\n\n\n
This section covers OpenSSL commands that are related to generating CSRs (and private keys, if they do not already exist). CSRs can be used to request SSL certificates from a certificate authority.<\/p>\n\n\n\n
Keep in mind that you may add the CSR information non-interactively with the -subj option, mentioned in the previous section.<\/p>\n\n\n\n
Generate a Private Key and a CSR<\/h3>\n\n\n\n
Use this method if you want to use HTTPS (HTTP over TLS) to secure your Apache HTTP or Nginx web server, and you want to use a Certificate Authority (CA) to issue the SSL certificate. The CSR that is generated can be sent to a CA to request the issuance of a CA-signed SSL certificate. If your CA supports SHA-2, add the -sha256 option to sign the CSR with SHA-2.<\/p>\n\n\n\n
This command creates a 2048-bit private key (domain.key) and a CSR (domain.csr) from scratch:<\/p>\n\n\n\n
openssl req \\\n -newkey rsa:2048 -nodes -keyout domain.key \\\n -out domain.csr<\/code><\/pre>\n\n\n\nAnswer the CSR information prompt to complete the process.<\/p>\n\n\n\n
The -newkey rsa:2048 option specifies that the key should be 2048-bit, generated using the RSA algorithm. The -nodes option specifies that the private key should not be encrypted with a pass phrase. The -new option, which is not included here but implied, indicates that a CSR is being generated.<\/p>\n\n\n\n
Generate a CSR from an Existing Private Key<\/h3>\n\n\n\n
Use this method if you already have a private key that you would like to use to request a certificate from a CA.<\/p>\n\n\n\n
This command creates a new CSR (domain.csr) based on an existing private key (domain.key):<\/p>\n\n\n\n
openssl req \\\n -key domain.key \\\n -new -out domain.csr<\/code><\/pre>\n\n\n\nAnswer the CSR information prompt to complete the process.<\/p>\n\n\n\n
The -key option specifies an existing private key (domain.key) that will be used to generate a new CSR. The -new option indicates that a CSR is being generated.<\/p>\n\n\n\n
Generate a CSR from an Existing Certificate and Private Key<\/h3>\n\n\n\n
Use this method if you want to renew an existing certificate but you or your CA do not have the original CSR for some reason. It basically saves you the trouble of re-entering the CSR information, as it extracts that information from the existing certificate.<\/p>\n\n\n\n
This command creates a new CSR (domain.csr) based on an existing certificate (domain.crt) and private key (domain.key):<\/p>\n\n\n\n
openssl x509 \\\n -in domain.crt \\\n -signkey domain.key \\\n -x509toreq -out domain.csr<\/code><\/pre>\n\n\n\nThe -x509toreq option specifies that you are using an X509 certificate to make a CSR.<\/p>\n\n\n\n
Generating SSL Certificates<\/h2>\n\n\n\n
If you would like to use an SSL certificate to secure a service but you do not require a CA-signed certificate, a valid (and free) solution is to sign your own certificates.<\/p>\n\n\n\n
A common type of certificate that you can issue yourself is a self-signed certificate. A self-signed certificate is a certificate that is signed with its own private key. Self-signed certificates can be used to encrypt data just as well as CA-signed certificates, but your users will be displayed a warning that says that the certificate is not trusted by their computer or browser. Therefore, self-signed certificates should only be used if you do not need to prove your service\u2019s identity to its users (e.g. non-production or non-public servers).<\/p>\n\n\n\n
This section covers OpenSSL commands that are related to generating self-signed certificates.<\/p>\n\n\n\n
Generate a Self-Signed Certificate<\/h3>\n\n\n\n
Use this method if you want to use HTTPS (HTTP over TLS) to secure your Apache HTTP or Nginx web server, and you do not require that your certificate is signed by a CA.<\/p>\n\n\n\n
This command creates a 2048-bit private key (domain.key) and a self-signed certificate (domain.crt) from scratch:<\/p>\n\n\n\n
openssl req \\\n -newkey rsa:2048 -nodes -keyout domain.key \\\n -x509 -days 365 -out domain.crt<\/code><\/pre>\n\n\n\nAnswer the CSR information prompt to complete the process.<\/p>\n\n\n\n
The -x509 option tells req to create a self-signed certificate. The -days 365 option specifies that the certificate will be valid for 365 days. A temporary CSR is generated to gather information to associate with the certificate.<\/p>\n\n\n\n
Generate a Self-Signed Certificate from an Existing Private Key<\/h3>\n\n\n\n
Use this method if you already have a private key that you would like to generate a self-signed certificate with it.<\/p>\n\n\n\n
This command creates a self-signed certificate (domain.crt) from an existing private key (domain.key):<\/p>\n\n\n\n
openssl req \\\n -key domain.key \\\n -new \\\n -x509 -days 365 -out domain.crt<\/code><\/pre>\n\n\n\nAnswer the CSR information prompt to complete the process.<\/p>\n\n\n\n
The -x509 option tells req to create a self-signed certificate. The -days 365 option specifies that the certificate will be valid for 365 days. The -new option enables the CSR information prompt.<\/p>\n\n\n\n
Generate a Self-Signed Certificate from an Existing Private Key and CSR<\/h3>\n\n\n\n
Use this method if you already have a private key and CSR, and you want to generate a self-signed certificate with them.<\/p>\n\n\n\n
This command creates a self-signed certificate (domain.crt) from an existing private key (domain.key) and (domain.csr):<\/p>\n\n\n\n
openssl x509 \\\n -signkey domain.key \\\n -in domain.csr \\\n -req -days 365 -out domain.crt<\/code><\/pre>\n\n\n\nThe -days 365 option specifies that the certificate will be valid for 365 days.<\/p>\n\n\n\n
View Certificates<\/h2>\n\n\n\n
Certificate and CSR files are encoded in PEM format, which is not readily human-readable.<\/p>\n\n\n\n
This section covers OpenSSL commands that will output the actual entries of PEM-encoded files.<\/p>\n\n\n\n
View CSR Entries<\/h3>\n\n\n\n
This command allows you to view and verify the contents of a CSR (domain.csr) in plain text:<\/p>\n\n\n\n
openssl req -text -noout -verify -in domain.csr<\/code><\/pre>\n\n\n\nView Certificate Entries<\/h3>\n\n\n\n
This command allows you to view the contents of a certificate (domain.crt) in plain text:<\/p>\n\n\n\n
openssl x509 -text -noout -in domain.crt<\/code><\/pre>\n\n\n\nVerify a Certificate was Signed by a CA<\/h3>\n\n\n\n
Use this command to verify that a certificate (domain.crt) was signed by a specific CA certificate (ca.crt):<\/p>\n\n\n\n
openssl verify -verbose -CAFile ca.crt domain.crt<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Private Keys Create a Private Key Use this command to create a password-protected, 2048-bit private key (domain.key): Enter a password when prompted to complete the process. Verify a Private Key Use this command to check that a private key (domain.key) is a valid key: If your private key is encrypted, you will be prompted for […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[19],"class_list":["post-636","post","type-post","status-publish","format-standard","hentry","category-uncategorised","tag-openssl"],"_links":{"self":[{"href":"https:\/\/www.fukr.org.uk\/index.php?rest_route=\/wp\/v2\/posts\/636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.fukr.org.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fukr.org.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fukr.org.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fukr.org.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=636"}],"version-history":[{"count":1,"href":"https:\/\/www.fukr.org.uk\/index.php?rest_route=\/wp\/v2\/posts\/636\/revisions"}],"predecessor-version":[{"id":638,"href":"https:\/\/www.fukr.org.uk\/index.php?rest_route=\/wp\/v2\/posts\/636\/revisions\/638"}],"wp:attachment":[{"href":"https:\/\/www.fukr.org.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fukr.org.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fukr.org.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}