I used openSSL to create a .key and .csr file.
openssl req -new -newkey rsa:2048 -passout pass:myPassword -nodes -out myDomainName.csr -keyout myDomainName.key
I know the .csr file needs to be submitted to the certificate authority, but my asp net core object is expecting a .pfx file as input (I think)... how do I get the .pfx file ?? Do I convert the .key to .pfx somehow?
options.Listen(ipAddress, 443, listenOptions => {
listenOptions.UseHttps("myCertificate.pfx" /* how to get this file? */, password);
});
A csr (Certificate Signing Request) file is used by a Certificate Authority to create an SSL for you, which is the one that you use in your app, there is no conversion from csr to pfx you can do locally.
Note: They do not need your private key for this.
For a free alternative you can use this CA
Yes you can convert certificate csr + key files to pfx on your local machine by using openssl (understanding csr as certificate request and key as certificate private key).
To do so, you need to go into bin directory in openssl (at my machine it is located in c:\Program Files\OpenSSL-Win64\bin), copy there your csr + key files and run these two commands:
First you need to make a crt from csr + key
openssl x509 -req -in certificate.csr -signkey key.pem -out certificate.crt
Next you make pfx from crt + key
openssl pkcs12 -export -in certificate.crt -inkey key.pem -out certificate.pfx
Where key.pem is a file with your private key, and certificate.csr is a file with csr.
Done!
Of course you may want to use different options than defaults for your target key, so in that case please read more about openssl.
Related
I'm trying to generate a pfx file from a crt and a private key, and I keep getting No certificate matches private key.
No idea what's going on here.
I did:
openssl pkcs12 -export -out myaudiservice.com.pfx -inkey myaudiservice.com.key -in myaudiservice.com.crt -in gd_bundle-g2-g1.crt
Which gets me:
No certificate matches private key
So, I tried deleting everything, key, crt, cert chain, and then I generated a new CSR:
openssl req -new -newkey rsa:2048 -nodes -keyout myaudiservice.com.key -out myaudiservice.com.csr
Which generated a new key and new csr. I then uploaded the CSR to GoDaddy and requested the cert be re-keyed.
When that was done, I downloaded the new crt, and used the freshly generated key (from the openssl command used to generate the CSR), and I still get the same error.
Then, just as a sanity check I did:
mjb#bohr:~/Downloads/myaudiservice.com$ openssl x509 -noout -modulus -in myaudiservice.com.crt | openssl md5
(stdin)= 36d37e4f8f8672c127178a4a9cf32b89
mjb#bohr:~/Downloads/myaudiservice.com$ openssl rsa -noout -modulus -in myaudiservice.com.key | openssl md5
(stdin)= 36d37e4f8f8672c127178a4a9cf32b89
And they match....but I still get the:
No certificate matches private key
What can I try next?
You cannot have multiple -in arguments. It will just take the last, i.e. gd_bundle-g2-g1.crt. And no certificate in this file matches the key. Instead you should combine all certificates (and maybe even the key) into a single file and use this as argument for a single -in option.
I have create .pem file from .cert file using the below line in openssl.exe :
OpenSSL> x509 -inform der -in C:\Certificate\Binary_Certificate_245568.cer -out C:\Certificate\Binary_Cert.pem
It worked without any issues.
Then when I try to generate the pfx file from .cert and .pem file using the following statement I get error:
OpenSSL> pkcs12 -inkey C:\Certificate\Binary_Cert.pem -in C:\Certificate\Binary_Certificate_245568.cer -export -out C:\Certificate\SGS_VS_CERT.pfx
unable to load private key
34359836736:error:08064066:object identifier routines:OBJ_create:oid exists:crypto/objects/obj_dat.c:698:
34359836736:error:0909006C:PEM routines:get_name:no start line:crypto/pem/pem_lib.c:745:
error in pkcs12
Can anyone please advise what I am doing wrong as I need to generate .pfx file. Thanks
You can follow steps given below in order to create .pfx certificate by combining the external CA issued server(.cer), intermediate(.cer) and root(.cer) certificates into one file (.pfx) on redhat linux server using openssl tool :
A) To run below command for generating the CSR in linux using openssl tool -
[user#machine]$ openssl req -new -nodes -newkeys rsa:2048 -keyout myapp.mydomain.com.key -out myapp.mydomain.com.csr -sha256
Note : -nodes means 'NOT TO USE DES ALOGORITHM' and create multiple backup of this key file, which will be used again during certificate renewal.
B) To generate .pfx ( certificate chain sequence to be SERVER-CER --> INTERMEDIATE-CERT --> ROOT-CERT ) in linux using openssl.
SERVER-CERT myapp.mydomain.com.cer
INTERMEDIATE-CERT myintermediatecert.com.cer
ROOT-CERT myrootcert.cer
KEY FILE myapp.mydomain.com.key
STEP 1 - To combine all certificates in one pem certificate(myapp.mydomain.pem) using command 'cat' in redhat.
[user#machine]$ cat myapp.mydomain.com.cer myintermediatecert.com.cer myrootcert.cer > myapp.mydomain.com.pem (output pem cert)
STEP 2 - To convert PEM to PFX by importing the private key with password configured.
[user#machine]$ openssl pkcs12 -export -out myapp.mydomain.com.pfx -inkey myapp.mydomain.com.key -in myapp.mydomain.com.pem
Note : you will get an option to set the password to output .pfx file.
STEP 3 : To verify .pfx file using openssl by entering the password.
[user#machine]$ openssl pkcs12 -in myapp.mydomain.com.pfx -info
I have created self-signed SSL certificate using OpenSSL as follow:
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
This gave me certificate and private key in .pem file. I need to provide my public key to my clients in .cer or .crt format. Is there any way to get public key in .cer/.crt formats?
What I have already tried:
1. Generating public key in .pem format and trying to convert it to .cer or .crt [Didn't work]
To extract public key in .pem file [worked fine]:
`openssl x509 -pubkey -noout -in signer-cert.pem > signer-public-key-test.pem`
To convert it from .pem for .cer format
openssl x509 -inform PEM -in signer-public-key-test.pem -outform DER -out signer-public-key-test.cer
I get this error:
unable to load certificate
140067363030680:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:701:Expecting: TRUSTED CERTIFICATE
2. Converting my certificate to .cer (which I did fine) and trying to export public key using windows certificate export wizard as instructions given here
It didn't work either. I couldn't enable the option to export keys and the final output, when opened in notepad++ was garbage.
So my question is, is there any way to generate the certificate from scratch and have the public key in .cer or .crt file. OR generating the certificate in .pem format and later extracting public keys to .crt or .cer
Any help is deeply appreciated.
Since .cer and .crt usually mean "DER or PEM-DER X.509 certificate" I don't know what you mean by having the public key in that format.
If you mean you want a DER encoded SubjectPublicKeyInfo representing the public key, the second stage of your pipeline would be
openssl asn1parse -noout -out some.file
You can remove the intermediate with
openssl x509 -in signer-cert.pem -noout -pubkey |
openssl asn1parse -noout -out signer-public-key-test.der
(Newline added to remove scrollbar)
Or, skip the certificate middleman altogether:
openssl rsa -in key.pem -pubout -outform der -out signer-public-key-test.der
Seems pretty weird that you want that particular format, though.
I know their logical differences, their intended ways to use. What I want to know are, how both certificates differs in the procedure of generation, of their actual contents.
Suppose you'll generate a self-signed some certificate with following procedure:
generating a private CA certificate, assume that you've got "ca.crt".
generating a private key as openssl genpkey -algorithm RSA -out key.pem -outform PEM.
generating a CSR as openssl req -new -key key.pem -keyform PEM -out req.pem -outform PEM.
signing to the CSR as openssl ca -in req.pem -out cert.pem -cert ca.crt -keyfile key.pem -keyform PEM.
I searched the web a lot but I couldn't find out whether the procedure above and the contents of generated certificate get differed when I generate a server certificate and a client certificate.
Your answers are greatly appreciated. Thank you.
There is no difference in the format. Both are X.509 certificates with the use-for-SSL bit set.
I am having some serious problems with regards to being able to create a p12 file to place on my windows server.
I have used two different websites to be able to help me work out what i need to do:
http://www.raywenderlich.com/32960/apple-push-notification-services-in-ios-6-tutorial-part-1
The second website i used was a comment from within the website was the following:
http://arashnorouzi.wordpress.com/2011/06/19/sending-apple-push-notifications-in-asp-net-and-c-–-part-4-apns-sharp-c-wrapper-class/
First of all i create a Certificate signing request.
I then upload this to my app ID which alows me to generate a ape_dev certificate.
I then go to my key chain and navigate to the "keys" i export the .p12 certificate that i just created.
I now have three different files
My p12 file, my development certificate and my certificate signing request.
I then open terminal and i type the following:
$ openssl x509 -in aps_development.cer -inform der -out PushChatCert.pem
This then creates a new pem certificate.
The thing i type is the following
$ openssl pkcs12 -nocerts -out PushChatKey.pem -in PushChatKey.p12
It prompts for the password which i enter, i use the same password as the one when i created the certificates.
After i have done this I'm left with 2 new files both of which are PEM files.
I need to combine both of these PEM files into one p12 file for it to be able to work on my windows server.
I have tried combining it using the following line
openssl pkcs12 -export \
-in aps_developer_identity.pem \
-out aps_developer_identity.p12 \
-inkey APSCertificates.pem
This in fact works and gives me a p12 file.
I then switched back to he raywenderlich website and i typed the following:
$ openssl s_client -connect gateway.sandbox.push.apple.com:2195
-cert PushChatCert.pem -key PushChatKey.pem
It loads but i recieve the following error:
error:num=20:unable to get local issuer certificate
Please does any one know what im doing wrong im so fed up of going round in circles.
When i upload the certificate to the server and put the ad-hoc version off the application on the device im still not receiving any notifications that i am sending
Thanks in advance.
See if this answer helps Creating .pem file for APNS?
In short: openssl pkcs12 -in apns-dev-cert.p12 -out apns-dev-cert.pem -nodes -clcerts
When you first generated your CSR, you did it with a private key. This can be opaque depending on how you did it. What I do is generate the key with openssl and then make the CSR using that key. That key is then the 'in key' when you make the p12.
Here are my steps
The first step is to generate a Certificate Signing Request. This is the same as it would be for any SSL cert. You will need a private key for this.
openssl genrsa -out aps_development.key -passout pass:foobar 2048
Then you can make the CSR using that key you just created
openssl req -new -key aps_development.key -out CertificateSigningRequest.certSigningRequest -subj "/emailAddress=yourAddress#example.com, CN=John Doe, C=US"
From here you will go to developer.apple.com and revoke the current APN cert and make a new one. It will ask for your CSR and when its done it will give you a .cer file.
Convert the .cer file into a DER formatted .pem file (assuming aps_development.cer is the file you got in the download from the Apple developer site).
openssl x509 -in aps_development.cer -inform DER -outform PEM -out aps_development.pem
Convert the .pem to a .p12. You'll note that you are supplying the key file you made at the beginning of step 1. You will need the password you supplied there.
openssl pkcs12 -export -in aps_development.pem -inkey aps_development.key -out aps_development.p12