Image Added

Image Added

2.1 Importing certificate into cacert

Go to the JAVA_HOME\bin directory and run:

2.2 Importing certificate into jks keystore

Openssl certficate adminisration

Use Linux default openssl if possible

includes default trust store for certificates

Openssl on Windows

install a valid Openssl binary from

Compile Openssl for Windows or get a binary package

only if needed ( usually on Windows if a binary not available )

add a trust store

Use or Create a Trust Store

either use system trust store or get Mozilla trust store

Windows Certificates Trust Store via mmc

Image Modified

Mozilla Root Certificate trust store text file

https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Download & Install Windows Openssl binary

https://slproweb.com/products/Win32OpenSSL.html

For Windows, create openssl_start.bat

sets up openssl environment in Windows

openssl_start.bat.txt

WARNING: can't open config file: /usr/local/ssl/openssl.cnf

This can be solved as following:

1. Close OpenSSL.
2. Open a Command Prompt (CMD) as Administrator
3. Run the following command: SET OPENSSL_CONF=<<my openssl bin path>>\openssl.cnf

Create Keystore, Admin key, User key & cert

use pkcs12 keystore

all key types and portable to any language

Generate a private key for the admin

if using a protected passfile, store in protected zip w option name + dddd

D:\dsfw\files\keyhome>

openssl genrsa -aes256 -passout file:passfile.txt -out jemason1.key 2048

Generating RSA private key, 2048 bit long modulus

..............+++++

.........................................................................................................+++++

e is 65537 (0x010001)

The password file ideally is in UTF-8 encoding for openssl

type or cat the key file to see the encrypted text for the private key generated

type jemason1-pub.pem | more

-----BEGIN PUBLIC KEY-----
.... << more >> ...
-----END PUBLIC KEY-----

create the public key from the private key file

openssl rsa -in jemason1.key -out jemason1-pub.key -pubout

key files output:

jemason1-pub.key jemason1.key passfile.txt

OpenSSL on Linux

error - unknown option on openssl command - can't copy dashes

Search Results
Web results

openssl keeps giving me "unknown option" errors - Server Fault
https://serverfault.com › questions › openssl-keeps-giving-me-unknown-o...
2 answers
Aug 13, 2011 - Delete all of your dashes and re-type them on the command line. when you wish to copy and paste! the - in the out so use arrows to get there and remove - and then type - and press enter, the - near the out is the only - you need to delete and type then it works :D.

CSR - Certificate Signing Request

http://pdfviewer.softgateon.net/?state=%7B%22ids%22:%5B%2211xXUkWZp59faRNh_jjCvXjM1XvQ7R4e9%22%5D,%22action%22:%22open%22,%22userId%22:%22106992337469837643773%22%7D

Get details from the site admin for OU, Cname, email, challenge password  etc first

 openssl req -new -key fd.key -out fd.cs

Create a pkcs12 file store for certificates

PKCS 12. In cryptography, PKCS #12 defines an archive file format for storing many cryptography objects as a single file. It is commonly used to bundle a private key with its X.509 certificate or to bundle all the members of a chain of trust. ... The filename extension for PKCS #12 files is .p12 or .pfx .

The PKCS#12 or PFX format is a binary format for storing the server certificate, intermediate certificates, and the private key in one encryptable file. PFX files usually have extensions such as .pfx and .p12. PFX files are typically used on Windows machines to import and export certificates and private keys

https://www.openssl.org/docs/man1.1.1/man1/openssl-pkcs12.html

For PKCS#12 file parsing only -in and -out need to be used for PKCS#12 file creation -export and -name are also used.

Controlling order of keys in pkcs12 file

If none of the -clcerts, -cacerts or -nocerts options are present then all certificates will be output in the order they appear in the input PKCS#12 files. There is no guarantee that the first certificate present is the one corresponding to the private key. Certain software which requires a private key and certificate and assumes the first certificate in the file is the one corresponding to the private key: this may not always be the case. Using the -clcerts option will solve this problem by only outputting the certificate corresponding to the private key. If the CA certificates are required then they can be output to a separate file using the -nokeys -cacerts options to just output CA certificates.

creates a pkcs12 file from a public key

 openssl pkcs12 -export -in jemason1-pub.key -out jemason1.p12 -name "jmason Certificate"

jemfebapr

Tutorial - Create SSL certificates with OpenSSL

https://phoenixnap.com/kb/openssl-tutorial-ssl-certificates-private-keys-csrs

On Ubuntu

ssl folder  /usr/lib/ssl is a link to

/etc/ssl 

which contains   /certs openssl.cnf  /private

openssl.cnf has default values for a CSR otherwise they must be entered on CLI

openssl req –out certificatesigningrequest.csr -new -newkey rsa:2048 -nodes -keyout privatekey.key

create the new key  and csr request

openssl req –out jmason1.csr -new -newkey rsa:2048 -nodes -keyout jmason1.key

Image Modified

read the key

openssl req -in jmason1.csr -noout -text

Image Modified

Create a public key as a PEM file from private key

openssl rsa -in jmason1.key -outform PEM -pubout -out jmason1-pub.PEM

Create a PKCS12 format file that can be imported into a Windows keystore

Create self-signed certificate with openssl req

openssl-req, req - PKCS#10 certificate request and certificate generating utility

The req command primarily creates and processes certificate requests in PKCS#10 format. It can additionally create self signed certificates for use as root CAs for example.

openssl-x509, x509 - Certificate display and signing utility

https://www.openssl.org/docs/man1.1.1/

example 1 - create new self-signed root CA certificate, private and public key files and a password file

openssl req -x509 -sha256 -outform PEM -days 1000 -out jmason2-crt.pem -new -newkey rsa:2048 -nodes 
-keyout jmason2-key.pem -passin file:passfile.txt

Generating a RSA private key
...........................................................+++++
.....................................................................................+++++
writing new private key to 'jmason2-key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:US
State or Province Name (full name) [MA]:MA
Locality Name (eg, city) []:North Attleboro
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Paramount Software Solutions
Organizational Unit Name (eg, section) []:software
Common Name (e.g. server FQDN or YOUR name) []:Jim Mason
Email Address []:.

openssl req options

-outform DER|PEM

This specifies the output format, the options have the same meaning and default as the -inform option.

-in filename

This specifies the input filename to read a request from or standard input if this option is not specified. A request is only read if the creation options (-new and -newkey) are not specified.

-x509

This option outputs a self signed certificate instead of a certificate request. This is typically used to generate a test certificate or a self signed root CA. The extensions added to the certificate (if any) are specified in the configuration file. Unless specified using the set_serial option, a large random number will be used for the serial number.

If existing request is specified with the -in option, it is converted to the self signed certificate otherwise new request is created.

Openssl simple CA app to sign requests

https://www.openssl.org/docs/man1.1.0/man1/ca.html

openssl.org-ca.pdf

Potential Value Opportunities

Potential Challenges

Candidate Solutions

Step-by-step guide for Example

sample code block

Recommended Next Steps

Related articles