OpenSSL Tips & Tricks

Oct
26
2016
0
Time to read
less than 1 minute
Read so far
By crypto

Get into the correct directory:

cd /etc/pki/tls/certs

Generate key

openssl genrsa -des3 -out mike.key 4096

chmod 600 mike.key

Generate signing request

openssl req -new -key mike.key -out mike.csr

chmod 600 mike.csr

Get the CA to sign the request

openssl x509 -req -days 10000 -in mike.csr -out mike.cert \

-CA /etc/pki/tls/certs/army.ca/Army.ca_CA.cer \

-CAkey /etc/pki/tls/certs/army.ca/Army.ca_CA.key -CAcreateserial

openssl pkcs12 -export -in mike.cert -inkey mike.key -out mike.p12

Other OpenSSL Tricks

To strip the passphrase from a key (I.E. decrypt it)

openssl rsa -in mike.key -out mike-nopass.key

To display a cert's contents:

openssl x509 -text -in mike.cert

Create a PEM file with key and cert included:

cat mike-nopass.key mike.cert > mike.pem

Verify that a cert is ok to use as an HTTPS cert:

openssl verify -purpose sslserver -CAfile /etc/pki/CA/cacert.pem /etc/pki/CA/certs/Milnet_HTTP.crt

Creating a new CA

  1. cd /etc/pki/CA
  2. openssl req -config ../tls/openssl.cnf -new -x509 -extensions v3_ca -keyout private/ArmyCA.key -out certs/ArmyCA.crt -days 5000
  3. chmod 400 private/ArmyCA.key
  4. cd private
  5. ln -s ArmyCA.key cakey.pem
  6. cd ..
  7. ln -s certs/ArmyCA.crt cacert.pem
  8. openssl req -config ../tls/openssl.cnf -new -nodes -keyout private/Milnet_HTTP.key -out Milnet_HTTP.csr -days 5000
  9. openssl ca -config ../tls/openssl.cnf -policy policy_anything -out certs/Milnet_HTTP.crt -infiles Milnet_HTTP.csr
  10. cat certs/Milnet_HTTP.crt private/Milnet_HTTP.key > private/Milnet_HTTP-key-cert.pem