Im trying to use openssl on my mac to generate a csr. the problem is that I cant find the private key after it is generated. I think its being created in some other directory. but I cant find it. These are the commands that I use and the error message that I get:
user$ openssl genrsa 2048 -out myKey.pem
Generating RSA private key, 2048 bit long modulus
........................+++
...................................+++
e is 65537 (0x10001)
-----BEGIN RSA PRIVATE KEY-----
--------
-----END RSA PRIVATE KEY-----
user$ openssl req -sha256 -new -key myKey.pem -out csr.pem
Error opening Private Key myKey.pem
921:error:02001002:system library:fopen:No such file or directory:/SourceCache/OpenSSL098/OpenSSL098- 47.1/src/crypto/bio/bss_file.c:356:fopen('myKey.pem','r')
921:error:20074002:BIO routines:FILE_CTRL:system lib:/SourceCache/OpenSSL098/OpenSSL098-47.1/src/crypto/bio/bss_file.c:358:
unable to load Private Key
How do I solve this problem? Thanks.
From docs:
numbits
the size of the private key to generate in bits. This must be the last option specified.
Your -out argument is ignored. This works:
openssl genrsa -out myKey.pem 2048
or
openssl genrsa 2048 > myKey.pem
Related
I am currently developing a mini-program for Vodapay and I need to generate the RSA key pairs to be able to sign my requests to the Vodapay backend.
Is there a recommended method or suggested tools I should use in order to generate my public-private key-pair for my VodaPay mini-program?
I managed to figure this out, the keys need to be generated through open SSL and they need to be stored as a .pem file
The bash commands required to get the keys are as follows, it will create the keys
Create RSA 2048 Keysopenssl genrsa -out rsa_2048_key.pem 2048
Export Public Keyopenssl rsa -in rsa_2048_key.pem -out rsa_public_key.pem -pubout
Export Private Key with PKCS#8 Encodeopenssl pkcs8 -topk8 -in rsa_2048_key.pem -out rsa_private_key.pem -nocrypt
I have a private/public key that was generated by Putty in the following format:
SSH2 PUBLIC KEY rsa-key
However, I am trying to get it to work with Docebo API using the JWT Grant Type, which requires a different format (according to this post).
How would I convert my key(s) to work with that format? Is there a way within Putty?
I figured out the steps to take to get the proper format of key using OpenSSL:
openssl genrsa -out private.key 1024
openssl req -new -x509 -key private.key -out publickey.cer
openssl x509 -in publickey.cer -out publickey.pem
We run this command via Gem.
openssl pkcs8 -inform DER -in file_init.key -passin pass:secret -out file_key.pem
All works fine on shell, we wanna convert this line to openssl with ruby, we tried:
key_file = OpenSSL::PKey::RSA.new File.read('file_init'), 'secret'
puts key_file.to_pem_pkcs8
But we get:
`initialize': Neither PUB key nor PRIV key: nested asn1 error (OpenSSL::PKey::RSAError)
Any advice?
Ruby's openssl implementation doesn't handle pkcs8 encrypted der key-file.
There is a workaround (converting the der to PEM by base64 encoding the der + adding correct headers) here:
Load PKCS#8 binary key into Ruby
I am looking for ruby code to mimic below openssl smime encryption. I looked up other related topics but mostly were around signing. In snippet below cert.pem is a PEM-encoded X.509 certificate containing the PEM public key. token.txt file is the file to be encrypted.
openssl smime -encrypt -out encrypted.p7m -in token.txt cert.pem
Figured it.
token_plain_text = File.read("/path/to/token.txt")
cert = X509::Certificate.new("/path/to/cert.pem")
encrypted_object = OpenSSL::PKCS7.encrypt([cert], token_plain_text)
Got the encrypted string by outputting above object to string.
encrypted_str = encrypted_object.to_str
This has me confused:
Convert pfx to PEM:
openssl pkcs12 -in certificatename.pfx -out certificatename.pem
Do this dumps out a single plain text file.
Now how do I convert this plain text pem back to pfx?
The only commands I see to convert to pfx require the cer and private keys in separate files:
Convert CER and Private Key to PFX:
openssl pkcs12 -export -in certificatename.cer -inkey privateKey.key -out certificatename.pfx -certfile cacert.cer
Although I concur this is not really programming and arguably offtopic, numerous similar Qs about commandline tools (openssl, keytool, certutil etc) for (crypto) keys and certs are apparently accepted by the community (upvoted) -- but none I've seen directly addresses this point.
The different options on openssl pkcs12 -export allow you to provide the pieces in different files, but that is not required. If you do have the privatekey and chain of certs in one PEM file, as output by default by pkcs12 [not -export], you can let everything be read from that one file:
openssl pkcs12 -export -in file -out p12
# or ONLY IF the privatekey is first in the file
openssl pkcs12 -export <file -out p12
and you can even combine the pieces 'on the fly' as long as you put privatekey first:
cat privkey.pem mycert.pem chain.pem | openssl pkcs12 -export -out p12
You can use the command below to convert PEM (.pem, .crt, .cer) to PFX:
openssl pkcs12 -export -out **<your_new_file_name>**.pfx -inkey **<private_key_of_your_existing_certificate>**.key -in **<your_existing_certificate_file>**.crt
This will be very generic for all above mentioned files.