1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586 |
- ***** Create a self signed cert ************
- 1) openssl genrsa 512 > client-key.pem
- 2) openssl req -new -x509 -nodes -md5 -days 1000 -key client-key.pem > client-cert.pem
- 3) note sha1 would be -sha1
- -- adding metadata to beginning
- 3) openssl x509 -in client-cert.pem -text > tmp.pem
- 4) mv tmp.pem client-cert.pem
- ***** Create a CA, signing authority **********
- same as self signed, use ca prefix instead of client
- ***** Create a cert signed by CA **************
- 1) openssl req -newkey rsa:512 -md5 -days 1000 -nodes -keyout server-key.pem > server-req.pem
- * note if using exisitng key do: -new -key keyName
- 2) copy ca-key.pem ca-cert.srl (why ????)
- 3) openssl x509 -req -in server-req.pem -days 1000 -md5 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
- ***** To create a dsa cert ********************
- 1) openssl dsaparam 512 > dsa512.param # creates group params
- 2) openssl gendsa dsa512.param > dsa512.pem # creates private key
- 3) openssl req -new -x509 -nodes -days 1000 -key dsa512.pem > dsa-cert.pem
- ***** To convert from PEM to DER **************
- a) openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER
- to convert rsa private PEM to DER :
- b) openssl rsa -in key.pem -outform DER -out key.der
- **** To encrypt rsa key already in pem **********
- a) openssl rsa <server-key.pem.bak -des >server-keyEnc.pem
- note location of des, pass = yassl123
- *** To make a public key from a private key ******
- openssl rsa -in 1024rsa.priv -pubout -out 1024rsa.pub
- **** To convert to pkcs8 *******
- openssl pkcs8 -nocrypt -topk8 -in server-key.pem -out server-keyPkcs8.pem
- **** To convert from pkcs8 to traditional ****
- openssl pkcs8 -nocrypt -in server-keyPkcs8.pem -out server-key.pem
- **** ECC ******
- 1) make a key
- to see types available do
- openssl ecparam -list_curves
- make a new key
- openssl ecparam -genkey -text -name secp256r1 -out ecc-key.pem
|