I have generated pem and csr files using the below command.
openssl req -newkey rsa:2048 -keyout key.pem -out req.csr
After this, I sent csr file to the authority and got p7b certificate.
Now, I tried to convert p7b file to p12 format with the below commands.
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
openssl pkcs12 -export -out certificate.p12 -inkey key.pem -in certificate.cer
However, it gives the below error.
No certificate matches private key
error in pkcs12
How can I convert p7b file into p12 file format?
I think you must call privatekey file
openssl pkcs12 -export -inkey privateKey.key -out certificate.p12 -inkey key.pem -in certificate.cer
Related
I'm having a hard time creating a p12 key. Here are the steps I did:
1: openssl genrsa -out priv.key 4096
2: openssl req -new -sha256 -key priv.key -out priv.csr
3: Converted the csr into a priv.pem file from a website specially for this (payment gateway).
And here I'm stuck. According to this website following code can be used:
openssl pkcs12 -export -out Cert.p12 -in cert.pem -inkey key.pem -passin pass:root -passout pass:root
The problem for me is: I only have one pem key but the above requires two. So can I with only my pem key now convert it into a p12 key with password?
I have a PFX that I want to convert to a CRT and Key or PEM and Key to install on an NGINX endpoint. When I import the pfx to my cert store on my windows machine it creates the certificate, the intermediate chain, and the root CA.
If I take that PFX and run the following openssl commands I and bind it to the endpoint, I don't get all the certificates in the chain:
openssl pkcs12 -in ./GoDaddy.pfx -clcerts -nokeys -out pcc.crt -nodes -nokeys
openssl pkcs12 -in ./GoDaddy.pfx -nocerts -nodes -out pcc.rsa -nodes -nokeys
Is there a switch or command I can run to convert the PFX to a crt / rsa or pem /key with all of the certificates up the chain to the root CA?
Since you want everything, you just need to reduce the number of restrictions you are asking for.
so:
openssl pkcs12 -in ./GoDaddy.pfx -out ./GoDaddy.pem
If you read the documentation you will see what you are asking for:
-nocerts
No certificates at all will be output.
-clcerts
Only output client certificates (not CA certificates).
-nokeys
No private keys will be output.
-nodes
Don't encrypt the private keys at all.
You can extract ca-bundle, .crt and .key from .pfx using this.
# Extracting ca-certs..."
openssl pkcs12 -in ${filename}.pfx -nodes -nokeys -cacerts -out ${filename}-ca.crt
# Extracting key file..."
openssl pkcs12 -in ${filename}.pfx -nocerts -out ${filename}.key
# Extracting crt..."
openssl pkcs12 -in ${filename}.pfx -clcerts -nokeys -out ${filename}.crt
# combine ca-certs and cert files
cat ${filename}.crt ${filename}-ca.crt > ${filename}-full.crt
# Removing passphrase from keyfile"
openssl rsa -in ${filename}.key -out ${filename}.key
Link:
https://gist.github.com/mediaupstream/a2694859b1afa59f26be5e8f6fd4806a
I issued the following commands to create a signature for a file (linux kernel) :
openssl req -newkey rsa -keyout codesign.key -out codesign.req
openssl ca -config ca.cnf -extensions codesigning -in codesign.req -out codesign.crt
openssl cms -sign -binary -noattr -in vmlinuz -signer codesign.crt -inkey codesign.key -certfile ca.crt -outform DER -out vmlinuz.sig
The ca.cnf file is for my own private CA infrastructure and it has digitalSignature key usage extension and the codeSigning extended key usage extension enalbed.
How can i verify that the vmlinuz.sig is the signature of the vmlinuz ??
I want to use GnuTLS certtool to convert a PEM public and private key to a PKCS12 pfx bundle. I don't have openssl available to me on the target system. The equivalent command with openssl is:
openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt
$ certtool --load-certificate certificate.pem --load-privkey certificate.pem --to-p12 --outder --outfile certificate.pfx
I am playing with openssl 1.0.2a - specifically CMS support for ECC.
As a test I am doing a simple encrypt and decrypt.
I gave an RSA example as a known good working example / sanity test.
The ECC example fails.
Any ideas? TIA.
./openssl version
OpenSSL 1.0.2a 19 Mar 2015
echo -n 12345678123456781234567812345678 > sess.txt # 32 byte plaintext
#RSA works
./openssl genrsa -out rsa.key 2048
./openssl req -x509 -new -key rsa.key -out rsa.crt
./openssl cms -encrypt -in sess.txt -out rsaencsess.bin -outform PEM rsa.crt
./openssl cms -decrypt -in rsaencsess.bin -out rsadecsess.txt -inform PEM -inkey rsa.key
#AOK.
#EC fails
./openssl ecparam -name prime192v1 -genkey -out ecc.key
./openssl req -x509 -new -key ecc.key -out ecc.crt
./openssl cms -encrypt -in sess.txt -out encsess.bin -outform PEM ecc.crt
./openssl cms -decrypt -in encsess.bin -out decsess.txt -inform PEM -inkey ecc.key
Error decrypting CMS structure
error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:529:
OpenSSL's Steve Henson resolved it as follows: "RSA can decrypt without knowing the certificate but currently EC cannot. So try including the option -recip ecc.crt when you decrypt
this now works:
./openssl ecparam -name prime192v1 -genkey -out ecc.key
./openssl req -x509 -new -key ecc.key -out ecc.crt
./openssl cms -encrypt -in sess.txt -out encsess.bin -outform PEM ecc.crt
./openssl cms -decrypt -in encsess.bin -out decsess.txt -inform PEM -inkey ecc.key -recip ecc.crt # NOTE "-recip ecc.crt" is currently required else it won't work!