How can I open text files which seem to be PKCS #7 Certificates. These were archived onto floppy discs in the late 90s and have now been burned onto a CD. I am using windows 7 on my computer
OpenSSL and its pkcs7 command may help you to decode your documents. Adapt the parameters to your own needs.
openssl pkcs7 -in myfile.pem -print_certs -text
Related
In all docs, it is mentioned to add .crt and .key to traefik.toml.
In my case, I just have a .p12 file, it is possible to use a .p12 with traefik?
Let me start with differences between formats. Thanks to #sysadmin1138 for great explanation.
PEM - Governed by RFCs, its used preferentially by open-source
software. It can have a variety of extensions (.pem, .key, .cer,
.cert, more)
DER -
The parent format of PEM. It's useful to think of it as a binary
version of the base64-encoded PEM file. Not routinely used very much
outside of Windows.
.pkcs12 .pfx .p12 - Originally defined by RSA in the Public-Key
Cryptography Standards (abbreviated PKCS), the "12" variant was
originally enhanced by Microsoft, and later submitted as RFC 7292.
This is a passworded container format that contains both public and
private certificate pairs. Unlike .pem files, this container is fully
encrypted.
The main info about .p12 - it is fully encrypted and passworded container.
Take a quick look into traefik certificate.go
Package tls use only crypto/tls and crypto/x509.
package tls
import (
"crypto/tls"
"crypto/x509"
...
)
Look at crypto/x509: reading certificates from PKCS12 files github issue:
There was a try to add PKCS12 cert support into crypto/x509 but in the end it was not implemented.
As it was mentioned in comments, right way is to convert .p12.
Here is example hot to achieve it (thank to #mulaz):
openssl pkcs12 -in filename.pfx -nocerts -out filename.key
openssl pkcs12 -in filename.pfx -clcerts -nokeys -out filename.crt
And a source of the same: Tips : Using openssl to extract private key ( .pem file) from .pfx (Personal Information Exchange)
Hope it helps!
I am trying to use OpenSSL in the terminal. I have installed OpenSSL using brew install openssl. I want to convert a .pem file to another format that my hosting provider will accept.
I have tried several different formulations of the code and plying the certificate from different places but none seem to work and all give me various error messages including permission denied.
This is what I tried last...
openssl pkcs12 -in /Users/myname/fullchain.pem -inkey /Users/myname/privkey.pem -out /Users/myname/fullchain.pfx -cacerts
This is my output
4552226412:error:0DFFF0A8:asn1 encoding routines:CRYPTO_internal:wrong tag:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.250.1/libressl-2.6/crypto/asn1/tasn_dec.c:1125:
4552226412:error:0DFFF03A:asn1 encoding routines:CRYPTO_internal:nested asn1 error:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.250.1/libressl-2.6/crypto/asn1/tasn_dec.c:306:Type=PKCS12
What might this mean and what code should I be using?
Edit: I am getting output files but they are of course empty.
That error message is usually when the certificate format you pass to the command is not what it is expecting. The following command should solve it for you.
openssl pkcs12 -export -out /Users/myname/fullchain.pfx -inkey /Users/myname/privkey.pem -in /Users/myname/fullchain.pem
It should prompt you to enter an export password to encrypt the .pfx files content if it has succeeded.
I'm using a Microsoft Certification authority to sign some certificates from a corporate network. Using the certreq utility everything works fine, but I didn't found the purpose of the template anywhere.
In my case, I need to create some certificates requests in a Linux server (using OpenSSL) and then sign it using the Microsoft CA in another server (Windows Server 2012). The proccess is basicaly described below:
Create the .csr file and key in a Linux server (openssl req -newkey rsa:1024 -keyout myKey.key -out myCsr.csr -subj /CN=mydomain.com/O=Organization/C=US/ST=ST/L=City);
Send the csr file to Windows Server where the CA is installed;
Call certreq utility to create the certificate itself (certreq -submit -attrib "CertificateTemplate:MyWebServerTemplate" -config DOMAINCA\CA1 myCsr.csr myCert.cer);
When needed, send the cert to Linux again and convert the .cer in a .crt with the command openssl x509 -outform DER -in myCert.cer -out myCert.crt. This is needed when certreq is used with -binary option
As far I know, the choose of the template is mandatory but anything changes no matter which I choose. I tried to select many templates, but apparently anything changes
update:
After some tests, I noted that some templates actually changes some original info from CSR, but my question still is: What is the purpose of the template, since the info is all in the CSR, and why is it mandatory? How can I force the MS CA to use the CSR info?
I'm new on this certificate administration thing. Am I misunderstood something in the process?
I created a p12 file on my MacOS ElCaptain, using a .pem and .key file via openssl command :
openssl pkcs12 -export -in <PEM_file>.pem -inkey <PRIVATE_KEY>.key -out <FILENAME>.p12
Everything went ok. I was able to make my cURL calls using this p12.
When I did the same on my Ubuntu 14.04.5 LTS (with the same .pem and .key), I started to receive this message when I used cURL with the p12:
curl: (58) unable to use client certificate (no key found or wrong pass phrase?)
What I am missing?
curl supports about a dozen different SSL/TLS implementations and how certs&keys are supplied varies depending on which implementation is used in your build. Use curl -V (upper vee) to check. I'd guess, but don't know, the MacOS build uses SecureTransport; the (standard) package on my off-in-the-corner Ubuntu 14.04.4 definitely uses OpenSSL.
Per the man page and confirmed by experiment on my Ubuntu, this build wants PEM format files, not PKCS12. These are the same two files you used as input to openssl pkcs12 -export, or you can concatenate them and just use that for --cert (this can work because PEM format marks each block separately); and if you don't have them anymore you can just use openssl pkcs12 -in foo.p12 -out foo.pem (i.e. OMIT -export) to convert back.
I've been using a certificate that's stored on the server in a myserver.pfx file.
However, behavior is not the same in all browsers and some complain on account of, I think, a missing 'intermediate' certificate.
I've downloaded the intermediate certificate from Gandi: GandiStandardSSLCA.pem
Now, my question is, how can I add that intermediate certificate into the pfx file?
Although the server is windows, I'm trying to use openssl on a linux machine to manipulate the certificates, just because that's where I have openssl available. I'm assuming this doesn't matter.
One thing I've tried, is to use openssl to export myserver.pfx to myserver.pem, a text file. Then, with a text editor, I've added the text of GandiStandardSSLCA.pem to myserver.pem in hopes of then converting back to pfx format. However, I couldn't get openssl to do that conversion back to pfx.
Is this possible? If so, at the text editing stage, does it matter if the intermediate certificate text goes at the beginning or the end? Also, would I need to manufacture 'Bag Attributes' somehow?
Or, is the whole operation done in one line with openssl?
The .pfx file can be prepared by exporting the intermediate certificate .pem file with the below command example.
openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile more.crt
Reference:
https://www.ssl.com/how-to/create-a-pfx-p12-certificate-file-using-openssl/