112 lines
2.6 KiB
Markdown
112 lines
2.6 KiB
Markdown
# OpenSSL
|
|
|
|
For my SSL keys and certificates I always use:
|
|
* `.crt` for the certificates,
|
|
* `.key` for the keys and
|
|
* `.csr` for the CSRs
|
|
|
|
While technically not correct, I think this is more verbose.
|
|
|
|
## General commands
|
|
|
|
### Generate a new private key
|
|
|
|
The `-pkeyopt rsa_keygen_bits:2048` determines the key length. The default value is 1024.
|
|
`-outform PEM` controls the form of the key. Values are `PEM` and `DER`. If you want to encrypt the key add the following parameters: `-aes-128-cbc -pass pass:test123`. Instead of `-aes-128-cbc` you can use other ciphers (e.g. `-des3`). If you omit the `-pass` argument you will be asked for a password.
|
|
|
|
```
|
|
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -outform PEM -out private_key.key
|
|
```
|
|
|
|
### Generate a new private key and certificate
|
|
|
|
```
|
|
openssl req -x509 -newkey rsa:4096 -keyout private_key.key -out certificate.crt -sha256 -days 365
|
|
```
|
|
|
|
### Generate a new private key and certificate signing request (CSR)
|
|
|
|
```
|
|
openssl req -out signing_request.csr -new -newkey rsa:2048 -nodes -keyout private_key.key -sha256
|
|
```
|
|
|
|
### Generate a certificate signing request (CSR) for an existing private key
|
|
|
|
```
|
|
openssl req -out signing_request.csr -key private_key.key -new -sha256
|
|
```
|
|
|
|
### Pass Subject and SubjectAlternativeName directly:
|
|
|
|
```
|
|
-subj "/C=DE/CN=example.tld" -addext "subjectAltName=DNS:example.tld,DNS:example2.tld,IP:127.0.0.1"
|
|
```
|
|
|
|
### Generate a certificate signing request based on an existing certificate
|
|
|
|
```
|
|
openssl x509 -x509toreq -in certificate.crt -out signing_request.csr -signkey private_key.key
|
|
```
|
|
|
|
### Encrypt a (RSA) private key
|
|
|
|
```
|
|
openssl rsa -des3 -in unencrypted.key -out encrypted.key
|
|
```
|
|
|
|
### Decrypt a (RSA) private key
|
|
|
|
```
|
|
openssl rsa -in encrypted.key -out decrypted.key
|
|
```
|
|
|
|
## Checking commands
|
|
|
|
### Check a Certificate Signing Request (CSR)
|
|
|
|
```
|
|
openssl req -text -noout -verify -in signing_request.csr
|
|
```
|
|
|
|
### Get information about a private key
|
|
|
|
```
|
|
openssl rsa -text -noout -in private_key.key
|
|
```
|
|
|
|
### Check a private key
|
|
|
|
```
|
|
openssl rsa -check -in private_key.key
|
|
```
|
|
|
|
### Check a certificate
|
|
|
|
```
|
|
openssl x509 -text -noout -in certificate.crt
|
|
```
|
|
|
|
### Check a PKCS#12 file (.pfx or .p12)
|
|
|
|
```
|
|
openssl pkcs12 -info -in keystore.p12
|
|
```
|
|
|
|
## Debugging commands
|
|
|
|
### Compare md5 hashes of certificate, key and CSR
|
|
|
|
```
|
|
openssl x509 -noout -modulus -in certificate.crt | openssl md5
|
|
openssl rsa -noout -modulus -in private_key.key | openssl md5
|
|
openssl req -noout -modulus -in signing_request.csr | openssl md5
|
|
```
|
|
|
|
### Check an SSL connection.
|
|
|
|
All certificates (including intermediates) should be displayed.
|
|
|
|
```
|
|
openssl s_client -connect gitea.forkmissile.de:443
|
|
```
|