Openssl

Création key et csr

1
2
openssl genrsa 2048 > server.key
openssl req -new -key server.key > server.csr

Création/signature du cert

1
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Same with CA

1
openssl genrsa -des3 -out rootCA.key 4096
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 730 -out rootCA.crt

openssl genrsa -out mydomain.com.key 2048
openssl req -new -key mydomain.com.key -out mydomain.com.csr

openssl x509 -req -in mydomain.com.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out mydomain.com.crt -days 730 -sha256

Same with SAN

1
# cat server.conf
[ req ]
prompt = no
distinguished_name = dn
req_extensions = req_ext

[ dn ]
CN = www.mydomain.com
emailAddress = ssl@exemple.com
O = MaBoite
OU = IT
L = Paris
ST = IDF
C = FR

[ req_ext ]
subjectAltName = DNS: mydomain.com

openssl req -new -config mydomain.com.conf -key mydomain.com.key -out mydomain.com.csr

Vérification de la concordance des cert/key

1
2
3
openssl x509 -noout -modulus -in server.crt | openssl md5
openssl rsa -noout -modulus -in server.key | openssl md5
openssl req -noout -modulus -in server.csr | openssl md5

Vérification de la concordance des cert/CA

1
2
openssl verify -CAfile ca.crt server.crt
openssl pkcs12 -in server.p12 -out server.crt -nodes

Lecture d’un certif

1
openssl x509 -in certificat.pem -noout -text

Conversion x509 to p12

1
openssl pkcs12 -export -out certif.p12 -inkey userkey.pem -in usercert.pem

Conversion openssh key to openssl key

1
ssh-keygen -f mysshgeneratekey.key -i

Remove passphrase

1
openssl rsa -in key.pem -out newkey.pem

Check du certif

1
echo | openssl s_client -showcerts -servername google.com -connect gnupg.org:443 2>/dev/null | openssl x509 -inform pem -noout -text