mag37 / OpenSSL_tricks.md

Request, create and verify new certificates

Prerequisite: Have a collection of openssl.conf files named as their hostname, eg

• gw1.conf
• gw2.conf
• lb1.conf

Create new passwords for every conf:

for i in *.conf; do openssl rand -base64 32 > ${i%.conf}.pass; done

Create new key files with passwords from file:

for i in *.conf; do openssl genrsa -aes256 -passout file:${%i.conf}.pass -out ${i%.conf}.key 2048; done

Create CSRs:

for i in *.conf; do openssl req -new -key ${i%.conf}.key -passin file:${i%.conf}.pass -out ${i%.conf}.csr -config $i; done

Then with with the CER (created/received):

Create PEM from CER+KEY:

for i in *.cer; do cat $i ${i%.cer}.key > ${i%.cer}.pem; done

Verify each PEM against CA:

for i in *.pem; do openssl verify -verbose -x509_strict -CAfile ca.pem $i; done

Docs:

-nocerts      No certificates at all will be output.
-clcerts      Only output client certificates (not CA certificates).
-nokeys       No private keys will be output.
-nodes        Don't encrypt the private keys at all.

Examples:

# Only CA-certs:
openssl pkcs12 -in ${file}.pfx -nodes -nokeys -cacerts -out ${file}-ca.pem

# Only cert:
openssl pkcs12 -in ${file}.pfx -clcerts -nokeys -out ${file}.pem

# Only key:
openssl pkcs12 -in ${file}.pfx -nocerts -out ${file}.key

# Combine CA-cert and cert to full:
cat  ${file}.pem ${file}-ca.pem > ${file}-full.pem

# Remove passphrase:
openssl rsa -in ${file}.key -out ${file}.key

# Add passphrase:
openssl rsa -aes256 -in ${file}.key -out ${file}.key

Usecase with SED to remove bag attributes and only end up with clear certificate blobs:

# unecrypted key
openssl pkcs12 -in ${file}.pfx -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > ${file}.key
# client certificate
openssl pkcs12 -in ${file}.pfx -clcerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${file}.pem
# CA
openssl pkcs12 -in ${file}.pfx -cacerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${file}-ca.pem