blob: 41b8c062de32b4a1e347bbd79ee5349169562bc5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
|
***** Create a self signed cert ************
1) openssl genrsa 512 > client-key.pem
2) openssl req -new -x509 -nodes -md5 -days 1000 -key client-key.pem > client-cert.pem
3) note sha1 would be -sha1
-- adding metadata to beginning
3) openssl x509 -in client-cert.pem -text > tmp.pem
4) mv tmp.pem client-cert.pem
***** Create a CA, signing authority **********
same as self signed, use ca prefix instead of client
***** Create a cert signed by CA **************
1) openssl req -newkey rsa:512 -md5 -days 1000 -nodes -keyout server-key.pem > server-req.pem
* note if using exisitng key do: -new -key keyName
2) copy ca-key.pem ca-cert.srl (why ????)
3) openssl x509 -req -in server-req.pem -days 1000 -md5 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
***** To create a dsa cert ********************
1) openssl dsaparam 512 > dsa512.param # creates group params
2) openssl gendsa dsa512.param > dsa512.pem # creates private key
3) openssl req -new -x509 -nodes -days 1000 -key dsa512.pem > dsa-cert.pem
***** To convert from PEM to DER **************
a) openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER
to convert rsa private PEM to DER :
b) openssl rsa -in key.pem -outform DER -out key.der
**** To encrypt rsa key already in pem **********
a) openssl rsa <server-key.pem.bak -des >server-keyEnc.pem
note location of des, pass = yassl123
*** To make a public key from a private key ******
openssl rsa -in 1024rsa.priv -pubout -out 1024rsa.pub
**** To convert to pkcs8 *******
openssl pkcs8 -nocrypt -topk8 -in server-key.pem -out server-keyPkcs8.pem
**** To convert from pkcs8 to traditional ****
openssl pkcs8 -nocrypt -in server-keyPkcs8.pem -out server-key.pem
**** ECC ******
1) make a key
to see types available do
openssl ecparam -list_curves
make a new key
openssl ecparam -genkey -text -name secp256r1 -out ecc-key.pem
|
