mag37 / OpenSSL_tricks.md

Last active 2 weeks ago

Like 0

mag37 revised this gist 2 weeks ago · 1395174

1 file changed, 18 insertions, 10 deletions

opensssl_conversions.md

mag37 revised this gist 2 weeks ago · d43ee1a

1 file changed, 32 insertions

opensssl_conversions.md (file created)

mag37 revised this gist 1 month ago · 5aaf33b

No changes

mag37 revised this gist 1 month ago · 026be61

1 file changed, 30 insertions

openssl_tricks.md (file created)

			@@ -10,23 +10,31 @@ Docs:
10	10		Examples:
11	11		```sh
12	12		# Only CA-certs:
13		-	openssl pkcs12 -in ${cert}.pfx -nodes -nokeys -cacerts -out ${cert}-ca.pem
	13	+	openssl pkcs12 -in ${file}.pfx -nodes -nokeys -cacerts -out ${file}-ca.pem
14	14
15	15		# Only cert:
16		-	openssl pkcs12 -in ${cert}.pfx -clcerts -nokeys -out ${cert}.pem
	16	+	openssl pkcs12 -in ${file}.pfx -clcerts -nokeys -out ${file}.pem
17	17
18	18		# Only key:
19		-	openssl pkcs12 -in ${cert}.pfx -nocerts -out ${cert}.key
	19	+	openssl pkcs12 -in ${file}.pfx -nocerts -out ${file}.key
20	20
21		-	# CA+cert:
22		-	openssl pkcs12 -in ${cert}.pfx -nodes -nokeys -cacerts -clcerts -out ${cert}-full.pem
23		-
24		-	# Combine CA-cert and cert, if only got split parts:
25		-	cat ${cert}.pem ${cert}-ca.pem > ${cert}-full.pem
	21	+	# Combine CA-cert and cert to full:
	22	+	cat ${file}.pem ${file}-ca.pem > ${file}-full.pem
26	23
27	24		# Remove passphrase:
28		-	openssl rsa -in ${cert}.key -out ${cert}.key
	25	+	openssl rsa -in ${file}.key -out ${file}.key
29	26
30	27		# Add passphrase:
31		-	openssl rsa -aes256 -in ${cert}.key -out ${cert}.key
	28	+	openssl rsa -aes256 -in ${file}.key -out ${file}.key
	29	+	```
	30	+
	31	+	Usecase with SED to remove bag attributes and only end up with clear certificate blobs:
	32	+
	33	+	```sh
	34	+	# unecrypted key
	35	+	openssl pkcs12 -in ${file}.pfx -nocerts -nodes \| sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > ${file}.key
	36	+	# client certificate
	37	+	openssl pkcs12 -in ${file}.pfx -clcerts -nokeys \| sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${file}.pem
	38	+	# CA
	39	+	openssl pkcs12 -in ${file}.pfx -cacerts -nokeys \| sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${file}-ca.pem
32	40		```

		@@ -0,0 +1,32 @@
1	+	Docs:
2	+	```
3	+	-nocerts No certificates at all will be output.
4	+	-clcerts Only output client certificates (not CA certificates).
5	+	-nokeys No private keys will be output.
6	+	-nodes Don't encrypt the private keys at all.
7	+	```
8	+
9	+
10	+	Examples:
11	+	```sh
12	+	# Only CA-certs:
13	+	openssl pkcs12 -in ${cert}.pfx -nodes -nokeys -cacerts -out ${cert}-ca.pem
14	+
15	+	# Only cert:
16	+	openssl pkcs12 -in ${cert}.pfx -clcerts -nokeys -out ${cert}.pem
17	+
18	+	# Only key:
19	+	openssl pkcs12 -in ${cert}.pfx -nocerts -out ${cert}.key
20	+
21	+	# CA+cert:
22	+	openssl pkcs12 -in ${cert}.pfx -nodes -nokeys -cacerts -clcerts -out ${cert}-full.pem
23	+
24	+	# Combine CA-cert and cert, if only got split parts:
25	+	cat ${cert}.pem ${cert}-ca.pem > ${cert}-full.pem
26	+
27	+	# Remove passphrase:
28	+	openssl rsa -in ${cert}.key -out ${cert}.key
29	+
30	+	# Add passphrase:
31	+	openssl rsa -aes256 -in ${cert}.key -out ${cert}.key
32	+	```

		@@ -0,0 +1,30 @@
1	+	## Request, create and verify new certificates
2	+	Prerequisite:
3	+	Have a collection of `openssl.conf` files named as their hostname, eg
4	+	- gw1.conf
5	+	- gw2.conf
6	+	- lb1.conf
7	+
8	+	Create new passwords for every conf:
9	+	```sh
10	+	for i in *.conf; do openssl rand -base64 32 > ${i%.conf}.pass; done
11	+	```
12	+	Create new key files with passwords from file:
13	+	```sh
14	+	for i in *.conf; do openssl genrsa -aes256 -passout file:${%i.conf}.pass -out ${i%.conf}.key 2048; done
15	+	```
16	+	Create CSRs:
17	+	```sh
18	+	for i in *.conf; do openssl req -new -key ${i%.conf}.key -passin file:${i%.conf}.pass -out ${i%.conf}.csr -config $i; done
19	+	```
20	+
21	+	### Then with with the CER (created/received):
22	+
23	+	Create PEM from CER+KEY:
24	+	```sh
25	+	for i in *.cer; do cat $i ${i%.cer}.key > ${i%.cer}.pem; done
26	+	```
27	+	Verify each PEM against CA:
28	+	```sh
29	+	for i in *.pem; do openssl verify -verbose -x509_strict -CAfile ca.pem $i; done
30	+	```