I'm experimenting with Spring Boot to create a WebApp.
In order to create a SSL certificate I issue the following command:
keytool -alias devssl -keystore devssl.p12 -genkeypair -keyalg RSA -sigalg SHA256withRSA /
-keysize 2048 -storetype PKCS12 -validity 365 -dname "CN=Frankie, OU=Frankie O=Frankie, /
L=City, S=State, C=UK" -ext SAN=DNS:localhost,DNS:blueye,IP:127.0.0.1,IP:10.1.1.2"
Which from what I can understand means that such certificate will be valid for the following addresses:
localhost
blueye
127.0.0.1
10.1.1.2
The certificate is very easy to install on Spring:
server.ssl.key-store-type=PKCS12
server.ssl.key-store=devssl.p12
server.ssl.key-store-password=password
server.ssl.key-alias=devssl
security.require-ssl=true
After I install the certificate under Trusted Root Certification Authorities in Windows it also works great.
I just can't get it to work under iOS.
I email myself the certificate.
Install it on the iPhone.
But I always get the "this connection is not private".
Any idea how to make this work on iOS?
I was pushing on this trying to get iOS to accept a self-signed certificate as the single source of truth. I got to work around it by issuing a proper personal Certificate Authority. Making iOS trust that authority. And then signing the website with a certificate validated by that authority.
I will describe the needed commands as they may save someone a couple of hours. The following is a "birds eye" of what we'll do.
AUTHORITY - this will act as the source of trust for all certificates you sign. You will have to install the Authority on every single machine/phone you'll want with custom certificates
Generate a private key for a Certificate Authority (CA)
Generate a Certificate for the Certificate Authority (CA)
Install Certificate Authority on Windows
Install Certificate Authority on iOS
CLIENT - we can issue private keys for all our projects inside our network. Those private keys will be validated by our own generated and installed authority.
Generate a private key for the client
Generate a Certificate Sign Request (CSR)
Have CA sign the CSR thus generating the client Certificate
Merge the client certificate and the CA certificate into a pkcs12 file which is read by Spring
Now for the actual commands:
Generate a private key, we'll also use an identical command to generate one for the client:
openssl genrsa -des3 -out myCA.key 2048
Generate a certificate for your Certificate Authority. You'll be asked several questions, none of them really matter, they will only serve to identify your certificate to yourself.
openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1825 -out myCA.pem
openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1825 -out myCA.crt
You now have three files. The myCA.key (private key) and the myCA.pem and myCA.crt which are the certificate file for your certificate authority.
Install on Windows:
Click the myCA.crt file on Windows and follow screen instructions. Then click Start -> Run -> `` certmgr.msc`. It will open the Windows Certificate Manager. You will find the certificate you installed under "Intermediate Certification Authorities". You'll want to drag that file to "Trusted Root Certification Authorities".
Install on iOS:
Email the myCA.pem file to yourself. Open the email on iOS using the Apple Mail App. Follow the instructions and certificate will be installed. To uninstall you can go to Settings -> General -> Profile. After proper installation iOS requires a second step for you to trust the certificate, you must go to Settings -> General -> About -> Certificate Trust Settings and Enable Full Trust For Root Certificate.
You now have a local CA (Certificate Authority) installed on both your Windows machine and your iOS phone. Lets create a website certificate.
Generate a private key for the website.
openssl genrsa -des3 -out myWebsite.key 2048
Generate a CSR (Certificate Sign Request):
openssl req -new -key myWebSite.key -out myWebsite.csr
Now that we have the website key and the certificate sign request we need to create a config file that openssl will use to generate our website certificate. Create a file called myWebsite.ext with the following info. The only thing you must make sure is the alt names. You can have both IP's and DNS. Be sure to enter all the alternatives that your site will use.
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = #alt_names
[alt_names]
DNS.1 = localhost
DNS.2 = mywebsite
DNS.3 = mywebsite.local
IP.1 = 10.1.1.3
IP.2 = 127.0.0.1
Now we'll use the CA certificate and private key together with the CSR (Certificate Sign Request) and the config file to generate a proper certificate for the website. Since iOS 13 Apple only allows a max of 825 days on certificates so that's what we'll use.
openssl x509 -req -in myWebsite.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial -out myWebsite.crt -days 825 -sha256 -extfile myWebsite.ext
You'll now have the following files:
myCA.key - certificate authority private key
myCA.pem - certificate authority certificate pem format
myCA.crt - certificate authority certificate crt format
myWebsite.key - website private key
myWebsite.csr - website certificate sign request
myWebsite.ext - website config file for openssl sign request
myWebsite.crt - website certificate crt format
The only thing missing is to convert the myWebsite.crt to p12 format which we can do with the following command:
openssl pkcs12 -export -in myCA.crt -inkey myCA.key -in myWebsite.crt -inkey myWebsite.key -name myWebsite -out myWebsite.p12
Now, to make Spring Boot use this certificate just open application.properties file and make sure it has these lines:
server.ssl.key-store-type=PKCS12
# The path to the keystore containing the certificate, place it src/main/resources
server.ssl.key-store=classpath:myWebsite.p12
# The password used to generate the certificate
server.ssl.key-store-password=PASSWORD-USED
# The alias mapped to the certificate (the -name myWebsite on the last command)
server.ssl.key-alias=myWebsite
# force SSL
security.require-ssl=true
And there you have it. A dev or internal project with proper SSL validation. Hope this saves someone some time.
It looks like you were having trouble creating the certificates correctly, for a great guide on how to do that, check out:
https://jamielinux.com/docs/openssl-certificate-authority/introduction.html
If you follow it exactly, and know what your DNS name is, and what cipher you are using, you shouldn't have any problems. I provide my configuration files for making the certificates, along with a project that helps with sockets, below:
https://github.com/eamonwhiter73/IOSObjCWebSockets
I've been trying to create a self-signed certificate for a public ip that I created in Azure to host a Node-Red instance and it seems that in Node-Red it needs PEM files to enable HTTPS.
I've have tried to create these files using OPENSSL.
openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout key.pem -out cert.pem
However when I try to access it, it says that the certificate is invalid.
Are there any other ways to make a self-signed certificate ??
The error is because your browser doesn't know to trust the certificate because it is not signed by one of it's trusted Certificate Authorities.
You have 3 options
If you look closely on the page there will be a way to ignore the error and continue to load the page.
You can import the certificate (since it is self signed) into the browers list of trusted certificates (if you tick the right box in option 1 this will basically happen automatically)
Rather than use a self signed certificate (Which really shouldn't be used for anything that is attached to a public IP address these days) you should use a real certificate from LetsEncrypt. These are free and already trusted by your browser.
Before questioning here. I've searched a lot about my problem. And problem is still exists. Below is the references of posts, which I've already read.
How to create .pfx file from certificate and private key?
Convert a CERT/PEM certificate to a PFX certificate
How to get .pem file from .key and .crt files?
How to generate a .pfx file from a .cer file?
Overview
I'm working on:
Windows 10 64bit
IIS (Version 10.0.16299.15)
I've installed Win32 OpenSSL v1.1.0g
These are the files that I have available:
server.cer
server.key
What I've tried?
I have also tried various things from trawling through posts but my lack of experience in this area is really impeding my efforts.
Below commands I have tried in Terminal to create my server.key and server.cer file.
set RANDFILE=c:\certificate\.md
set OPENSSL_CONF=c:\OpenSSL-Win32\bin\openssl.cfg
c:\OpenSSL-Win32\bin\openssl.exe genrsa -out server.key 2048`
c:\OpenSSL-Win32\bin\openssl.exe req -new -key server.key -out server.cer -config C:\OpenSSL-Win32\bin\openssl.cfg
c:\OpenSSL-Win32\bin\openssl.exe pkcs12 -export -in server.cer -inkey server.key -out server.pfx
Output
Error: unable to load certificates
What I want?
How to create .pfx file from certificate and private key? Let me know what I'm doing wrong in my code.
Although, the question is answered, I would like to add a simpler solution.
There is no need to use any 3rd party tools (including OpenSSL) on Windows. You can use built-in certutil.exe tool. Place both files in the same folder and give the same name to files (e.g. server.cer and server.key) and run the following command:
certutil -mergepfx path\server.cer
Certutil will expect to find a key file in the same folder with .key file extension.
The req command creates a certificate request by default, not a certificate. If you add the -x509 argument, it will self-sign the request using the provided key, and output a certificate instead. You should then be able to create the .pfx successfully.
i'm applying a digital signature to my executable. Using signtool on Windows XP or Windows Vista:
>signtool.exe sign /f "avatar.pfx" MyApp.exe
automatically included the entire certification chain in the digital signature.
Starting with Windows 7 the entire certification chain is no longer included. You must manually include the certificate that:
signed your key
signed the certificate that signed your key
...
...until there are no more certificates to include
i am told that i have to do this using the /ac switch with the signtool utility.
From MSDN documentation of signtool:
/ac FileName
Specifies a file that contains an additional certificate to add to the signature block.
How do i get the filename of the certificate that signed my certificate?
It's more confusing because i don't have any such file. i have my digitally signed executable with no embedded certification chain:
Stackoverflow user davidcl had the same question. In this self-answered answer he says that i need to
do the signing using a PFX file that contains the root certificate, intermediate certificate, developer certificate, and private key.
After creating the appropriate PFX file - which was an odyssey in itself...
But he doesn't give how he created the PFX that contains the entire certification chain.
See also
How can I sign an ActiveX control with a code signing certificate and be a verified publisher?
Signing WinForms ClickOnce app with Certificate Chain
ClickOnce: Certificate cannot be validated
How to include entire certification path when signing code with signtool?
Install OpenSSL for Windows. Once accomplished, you have the openssl.exe executable somewhere on your system.
Now proceed as follows.
openssl pkcs12 -in avatar.pfx -out avatar.pem -nodes
(You need to enter the .pfx password here)
openssl pkcs12 -in avatar.pfx -out mycert.pem -nodes -clcerts
(again the PW)
openssl x509 -in mycert.pem -out mycert.cer -outform DER
Now open your Explorer and double-click on the mycert.cer. View the details and somewhere it will talk about an issuer. This is the company that issued your key store, your next goal is to get their intermediate certificates and the final root certificate. If you are lucky, there is an extension called "Authority Information Access" in your certificate that tells you where to get the issuing certificate directly. If you are not so lucky, then you will find a URL for OCSP access in the "Authority Information Access" or a URL for CRLs in the extension "CRL Distribution Points". These should at least give you a vague idea of the vendor's "homepage". In case of doubt, just google around, or ask me again :)
If you are on the vendor's page, you will have to watch out for "CA certificates" or "Intermediate Certificates". You need to download the one whose name is exactly the same as what you found in the "Issuer" field of your own certificate.
Now the funny part: The certificate you just found will again have an "Issuer" field. Lucky you if the issuer is the same company (typically the case for large CAs such as VeriSign), then you will find the corresponding certificate on the same site you are currently on. If not, repeat the previous steps.
Repeat this cumbersome procedure until you're at a point where you have found a certificate whose "Subject" field is exactly the same as its "Issuer" field. You're done then. This is a so-called "self-signed root certificate".
Most of these certificates will come in "DER"/"ASN.1"/"X.509" format - if you have the choice, download "PEM" format, otherwise you will first need to convert the certificates into "PEM" format by
openssl x509 -in cert.der -inform DER -out cert.pem
Once you have all the missing certificates in PEM format
open the initial file created in step 1, avatar.pem, in a text editor.
open the missing certificate PEM files in separate windows
copy the missing certificates (the entire file, including the "----- BEGIN CERTIFICATE -----" and "----- END CERTIFICATE -----") and append them to avatar.pem
save the result
issue
openssl pkcs12 -export -in avatar.pem -out newavatar.pfx -name ""
You will have to enter a new password that is to be used with the new file.
Minor addendum to Ian's comment above "In the end I had a much easier way to get a .cer...". These days when you export your code signing pfx from the Thawte webpage, you can specify that you want the entire chain included. Hence you can import the pfx with certmgr.msc and then export the single Thawte intermediate certificate as a codesign.cer file. Then use that with the signtool /ac switch. No need to have an old signed app. Be sure to delete your temp certificate in the store, so your test of the newly signed app is valid. --William Croft
I need .pfx file to install https on website on IIS.
I have two separate files: certificate (.cer or pem) and private key (.crt) but IIS accepts only .pfx files.
I obviously installed certificate and it is available in certificate manager (mmc) but when I select Certificate Export Wizard I cannot select PFX format (it's greyed out)
Are there any tools to do that or C# examples of doing that programtically?
You will need to use openssl.
openssl pkcs12 -export -out domain.name.pfx -inkey domain.name.key -in domain.name.crt
The key file is just a text file with your private key in it.
If you have a root CA and intermediate certs, then include them as well using multiple -in params
openssl pkcs12 -export -out domain.name.pfx -inkey domain.name.key -in domain.name.crt -in intermediate.crt -in rootca.crt
If you have a bundled crt file that you use, for example, with nginx, you can pass that in along with the cert all in one:
cat domain.name.crt | tee -a domain.name.bundled.crt
cat intermediate.crt | tee -a domain.name.bundled.crt
cat rootca.crt | tee -a domain.name.bundled.crt
openssl pkcs12 -export -out domain.name.pfx \
-inkey domain.name.key \
-in domain.name.bundled.crt
You can install openssl from here: openssl
If you're looking for a Windows GUI, check out DigiCert. I just used this and it was fairly simple.
Under the SSL tab, I first Imported the Certificate. Then once I selected the Certificate I was able to export as a PFX, both with and without a keyfile.
https://www.digicert.com/util
The Microsoft Pvk2Pfx command line utility seems to have the functionality you need:
Pvk2Pfx (Pvk2Pfx.exe) is a command-line tool copies public key and private key information contained in .spc, .cer, and .pvk files to a Personal Information Exchange (.pfx) file.
http://msdn.microsoft.com/en-us/library/windows/hardware/ff550672(v=vs.85).aspx
Note: if you need/want/prefer a C# solution, then you may want to consider using the http://www.bouncycastle.org/ api.
You do NOT need openssl or makecert or any of that. You also don't need the personal key given to you by your CA. I can almost guarantee that the problem is that you expect to be able to use the key and cer files provided by your CA but they aren't based on "the IIS way".
SSL Certs for IIS with PFX once and for all - SSL and IIS Explained - http://rainabba.blogspot.com/2014/03/ssl-certs-for-iis-with-pfx-once-and-for.html
Use IIS "Server Certificates" UI to "Generate Certificate Request" (the details of this request are out of the scope of this article but those details are critical). This will give you a CSR prepped for IIS. You then give that CSR to your CA and ask for a certificate. Then you take the CER/CRT file they give you, go back to IIS, "Complete Certificate Request" in the same place you generated the request. It may ask for a .CER and you might have a .CRT. They are the same thing. Just change the extension or use the . extension drop-down to select your .CRT. Now provide a proper "friendly name" (*.yourdomain.example, yourdomain.example, foo.yourdomain.example, etc..) THIS IS IMPORTANT! This MUST match what you setup the CSR for and what your CA provided you. If you asked for a wildcard, your CA must have approved and generated a wildcard and you must use the same. If your CSR was generated for foo.yourdomain.example, you MUST provide the same at this step.
Solution for Windows that doesn't require OpenSSL installed
I recently was trying to solve the same issue - and I only had a windows laptop with no openssl installed (and no enough admin rights to install it). Turns out windows has built-in utility called certutil that is capable of combining .crt and .key files into .pfx. Docs are here.
You need to create a new folder and place you .crt and key files in it. Rename both files to have the same name (but different extension):
{{sitename}}.crt
{{siteName}}.key
In case your key file is a regular txt - just change extension to .key.
After that open cmd in that folder and run certutil -mergepfx [INPUTFILE] [OUTPUTFILE]
Example:
certificate file: mySite.crt
key file: mySite.key
certutil command: certutil -mergepfx mySite.crt mySite.pfx
Note: you will be asked to provide password for newly created .pfx file - don't forget to memorise/store it - as it will be required during certificate import on the target system.
I created .pfx file from .key and .pem files.
Like this openssl pkcs12 -inkey rootCA.key -in rootCA.pem -export -out rootCA.pfx
https://msdn.microsoft.com/en-us/library/ff699202.aspx
(( relevant quotes from the article are below ))
Next, you have to create the .pfx file that you will use to sign your deployments. Open a Command Prompt window, and type the following command:
PVK2PFX –pvk yourprivatekeyfile.pvk –spc yourcertfile.cer –pfx yourpfxfile.pfx –po yourpfxpassword
where:
pvk - yourprivatekeyfile.pvk is the private key file that you created in step 4.
spc - yourcertfile.cer is the certificate file you created in step 4.
pfx - yourpfxfile.pfx is the name of the .pfx file that will be creating.
po - yourpfxpassword is the password that you want to assign to the .pfx file. You will be prompted for this password when you add the .pfx file to a project in Visual Studio for the first time.
(Optionally (and not for the OP, but for future readers), you can create the .cer and .pvk file from scratch) (you would do this BEFORE the above). Note the mm/dd/yyyy are placeholders for start and end dates. see msdn article for full documentation.
makecert -sv yourprivatekeyfile.pvk -n "CN=My Certificate Name" yourcertfile.cer -b mm/dd/yyyy -e mm/dd/yyyy -r
From this links:
https://serverfault.com/a/224127/569310
https://stackoverflow.com/a/49784278/7856894
https://stackoverflow.com/a/17284371/7856894
If you need, use this simple command sequence with OpenSSL to generate filessl.key (SSL certificate key file), and filessl.crt (SSL certificate file):
openssl genrsa 2048 > filessl.key
chmod 400 filessl.key
openssl req -new -x509 -nodes -sha256 -days 365 -key filessl.key -out filessl.crt
Until here you must respond to the interactive form (you can find reference info like req.cnf from this other post: https://stackoverflow.com/a/49784278/7856894)
Then, continue with this last command, which will ask you type the Export Password:
openssl pkcs12 -export -out filessl.pfx -inkey filessl.key -in filessl.crt
Ready, it generated your SSL certificate file in .PFX (or .P12) format: filessl.pfx.
This is BY FAR the easiest way to convert *.cer to *.pfx files:
Just download the portable certificate converter from DigiCert:
https://www.digicert.com/util/pfx-certificate-management-utility-import-export-instructions.htm
Execute it, select a file and get your *.pfx!!
You need to use the makecert tool.
Open a command prompt as admin and type the following:
makecert -sky exchange -r -n "CN=<CertificateName>" -pe -a sha1 -len 2048 -ss My "<CertificateName>.cer"
Where <CertifcateName> = the name of your cert to create.
Then you can open the Certificate Manager snap-in for the management console by typing certmgr.msc in the Start menu, click personal > certificates > and your cert should be available.
Here is an article.
https://azure.microsoft.com/documentation/articles/cloud-services-certs-create/
I got a link with your requirement.Combine CRT and KEY Files into a PFX with OpenSSL
Extracts from the above link:
First we need to extract the root CA certificate from the existing
.crt file, because we need this later. So open up the .crt and click
on the Certification Path tab.
Click the topmost certificate (In this case VeriSign) and hit View
Certificate. Select the Details tab and hit Copy to File…
Select Base-64 encoded X.509 (.CER) certificate Save it as rootca.cer
or something similar. Place it in the same folder as the other files.
Rename it from rootca.cer to rootca.crt Now we should have 3 files in
our folder from which we can create a PFX file.
Here is where we need OpenSSL. We can either download and install it
on Windows, or simply open terminal on OSX.
EDIT:
There is a support link with step by step information on how to do install the certificate.
After successfully install, export the certificate, choose .pfx format, include private key.
Important Note: : To export the certificate in .pfx format you need to follow the steps on the same machine from which you have requested the certificate.
The imported file can be uploaded to server.
When you say the certificate is available in MMC, is it available under "Current User" or "Local Computer"? I've found that I can only export the private key if it is under Local Computer.
You can add the snap in for Certificates to MMC and choose which account it should manage certificates for. Choose Local Computer. If your certificate is not there, import it by right clicking the store and choosing All Tasks > Import.
Now navigate to your imported certificate under the Local Computer version of the certificate snap in. Right click the certificate and choose All Tasks > Export. The second page of the export wizard should ask if you want to export the private key. Select Yes. The PFX option will now be the only one available (it is grayed out if you select no and the option to export the private key isn't available under the Current User account).
You'll be asked to set a password for the PFX file and then to set the certificate name.
I was trying openssl on macbook with libreSSL v2.8.3 and was getting error "No certificate matches private key". I had one domain cert, 2 intermediates and 1 root cert. So I used following command which worked successfully:
openssl pkcs12 -export -clcerts -inkey private.csr.key -in domain.name.crt -certfile intermediate1.crt -certfile intermediate2.crt -certfile root.crt -out domain.name.p12 -name "Your Name"
It will ask for a password that will be used during import. This command will generate a .p12 file which can be renamed to .pfx as both are same.
I was having the same issue. My problem was that the computer that generated the initial certificate request had crashed before the extended ssl validation process was completed. I needed to generate a new private key and then import the updated certificate from the certificate provider. If the private key doesn't exist on your computer then you can't export the certificate as pfx. They option is greyed out.
I would like to promote the "X certificate and key manager" or xca.exe, it's like a GUI version of OpenSSL. With that you can generate the pfx file by the following steps:
Import private key in the "Private Keys" tab;
Import the certificate in the "Certificates" tab;
Generate the pfx file by selecting the certificate and then "Export", select PKCS #12 as the format.
That's it.
In most of the cases, if you are unable to export the certificate as a PFX (including the private key) is because MMC/IIS cannot find/don't have access to the private key (used to generate the CSR). These are the steps I followed to fix this issue:
Run MMC as Admin
Generate the CSR using MMC. Follow this instructions to make the certificate exportable.
Once you get the certificate from the CA (crt + p7b), import them (Personal\Certificates, and Intermediate Certification Authority\Certificates)
IMPORTANT: Right-click your new certificate (Personal\Certificates) All Tasks..Manage Private Key, and assign permissions to your account or Everyone (risky!). You can go back to previous permissions once you have finished.
Now, right-click the certificate and select All Tasks..Export, and you should be able to export the certificate including the private key as a PFX file, and you can upload it to Azure!
Hope this helps!
I've written a small console app which converts a PEM certificate file and a private key file to one .pfx PKCS12 certificate file.
It uses BouncyCastle library.
My Github repo: https://github.com/nklkli/PEM-to-PKCS12
Feel free to modify the code to create password protected *.pfx.
openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx