Skip to main content

Veritran Docs

[en] OpenSSL Commands

[en] You can run OpenSSL commands to execute different actions, such as creating, updating or extracting keys, or updating their format. See a list of possible commands below.

[en] Create an RSA key with a self-signed certificate
openssl req -x509 -new -nodes -key rsa_priv_key.key -days 3650 -out selfSignedCert.pem
[en] Create an RSA key of 2048 bits
openssl genrsa -out privkey.pem  -des3 2048
[en] Get the pub key of a previous RSA key
openssl rsa -in privkey.pem -pubout -out pubkey.pem
[en] Sign a certificate request with a custom CA
openssl ca -config ./openssl.cnf -in req.pem -out cert.pem

Nota

[en] The ./openssl.cnf file contains the custom CA parameters.

[en] Creating a self signed certificate with an existing RSA private key
openssl req -new -x509 -key privateKey.pem -out signedCertificate.cer
[en] Create a pkcs12 keystore with a previous key and certificate pair
openssl pkcs12 -export -inkey privkey.pem -in cert.pem -out keystore.p12 -name "Keystore Name"
[en] Show a pkcs12 keystore's contents
openssl pkcs12 -in keystore.p12
[en] Decrypt an encrypted private key
openssl rsa -in privkey.pem -out privkey_plain.pem
[en] Validate a public and private key pair
openssl rsa -noout -modulus -in file.key
openssl x509 -noout -modulus -in file.cer

Nota

[en] Both modulus parameters should be the same.

[en] Generate private key
openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048

Nota

[en] This command creates a private key and a public key.

[en] Generate public key from private key
openssl rsa -pubout -in private_key.pem -out public_key.pem
[en] Extract only the private key
openssl rsa -in private_key.pem -out private_unencrypted.key -outform PEM
[en] Show the private key's content
openssl rsa -text -in private_key.pem
[en] Encrypt with a public key
openssl rsautl -in test.txt -out test.txt.encrypted -pubin -inkey public_key.pem -encrypt
[en] Decrypt with a public key
openssl rsautl -in test.txt.encrypted -out test.txt.decrypted -inkey private_key.pem -decrypt
[en] Show certificate info
openssl x509 -outform PEM -in certificate.pem -text -out MyCertificate.info
[en] Create a custom CA

[en] Create a folder for storing CA certificates and then set the dir= property to point to it in openssl.cnf. See the related commands below.

[en] Create a CA certificate using openssl
openssl req -new -x509 -days 3650 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem
[en] Create a certificate request
openssl req -new -nodes -out provider-req.pem -keyout private/provider-key.pem
[en] Use the CA to generate the signed certificate using the request
openssl ca -out provider-cert.pem -infiles provider-req.pem
[en] Convert the signed certificate to pkcs12
openssl pkcs12 -export -in provider-cert.pem -inkey private/provider-key.pem > provider.p12
[en] Import a pkcs12 keystore into a JKS keystore
keytool -importkeystore -srckeystore provider.p12 -destkeystore /path/to/somekeystore.jks -srcstoretype pkcs12
: