OpenSSL - Revision history

Leo: Reverted edits by 174.241.28.194 (talk) to last revision by Leo

2022-02-07T02:39:24Z

Reverted edits by 174.241.28.194 (talk) to last revision by Leo

← Older revision		Revision as of 02:39, 7 February 2022
Line 49:		Line 49:

	=== Verification ===		=== Verification ===
	{\| class		{\| class="wikitable"
	!Task		!Task
	!Command		!Command
Line 76:		Line 76:
	\|{{highlight\|lang=terminal\|code=		\|{{highlight\|lang=terminal\|code=
	# openssl x509 -noout -modulus -in certificate.crt \| openssl md5		# openssl x509 -noout -modulus -in certificate.crt \| openssl md5
	# openssl rsa -noout -modulus -~~iopenssl~~ md5		# openssl rsa -noout -modulus -in privateKey.key \| openssl md5
			# openssl req -noout -modulus -in CSR.csr \| openssl md5
	}}		}}
	\|}		\|}




	==Checking & Verifying==		==Checking & Verifying==

174.241.28.194: /* Verification */

2022-02-06T21:47:55Z

Verification

← Older revision		Revision as of 21:47, 6 February 2022
Line 49:		Line 49:

	=== Verification ===		=== Verification ===
	{\| class~~="wikitable"~~		{\| class
	!Task		!Task
	!Command		!Command
Line 76:		Line 76:
	\|{{highlight\|lang=terminal\|code=		\|{{highlight\|lang=terminal\|code=
	# openssl x509 -noout -modulus -in certificate.crt \| openssl md5		# openssl x509 -noout -modulus -in certificate.crt \| openssl md5
	# openssl rsa -noout -modulus -~~in privateKey.key \| openssl md5~~		# openssl rsa -noout -modulus -iopenssl md5
	~~# openssl req -noout -modulus -in CSR.csr \| openssl~~ md5
	}}		}}
	\|}		\|}




	==Checking & Verifying==		==Checking & Verifying==

Leo: reformatting into a table

2020-12-02T18:58:10Z

reformatting into a table

Show changes

Leo: /* General OpenSSL Commands */

2019-09-24T16:33:41Z

General OpenSSL Commands

← Older revision		Revision as of 16:33, 24 September 2019
Line 4:		Line 4:
	These commands allow you to generate CSRs, Certificates, Private Keys and do other miscellaneous tasks.		These commands allow you to generate CSRs, Certificates, Private Keys and do other miscellaneous tasks.

	Generate a new private key ~~and Certificate Signing Request~~		Generate a new private key
	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
	# openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key		# openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
	}}		}}

	Generate a ~~self-signed certificate (see How to Create~~ and ~~Install an Apache Self Signed~~ Certificate ~~for more info)~~		Generate a new private key and Certificate Signing Request
	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
	# openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.crt		# openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.crt

Leo: /* General OpenSSL Commands */ view pem certs

2019-09-24T16:17:48Z

General OpenSSL Commands: view pem certs

← Older revision		Revision as of 16:17, 24 September 2019
Line 27:		Line 27:
	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
	# openssl rsa -in privateKey.pem -out newPrivateKey.pem		# openssl rsa -in privateKey.pem -out newPrivateKey.pem
			}}

			To view a PEM certificate
			{{highlight\|lang=terminal\|code=
			# openssl x509 -in certificate.crt -text
	}}		}}

Leo: organization

2019-09-12T16:53:45Z

organization

← Older revision		Revision as of 16:53, 12 September 2019
Line 29:		Line 29:
	}}		}}

			== Checking & Verifying ==

	== Checking ~~Using OpenSSL~~ ==

	If you need to check the information within a Certificate, CSR or Private Key, use these commands. You can also check CSRs and check certificates using our online tools.		If you need to check the information within a Certificate, CSR or Private Key, use these commands. You can also check CSRs and check certificates using our online tools.

Line 55:		Line 52:
	}}		}}

			If you are receiving an error that the private doesn't match the certificate or that a certificate that you installed to a site is not trusted, try one of these commands. It might be a good idea to use an online SSL checker service as well to determine what issues that are with the installed certificate.

	~~== Check Server SSL Certificate Using OpenSSL ==~~		The public key should match your private key and must be used in your certificate and certificate signing request. You can verify this by running:
	~~If you are receiving an error that the~~ private ~~doesn't match the~~ certificate ~~or that a~~ certificate ~~that you installed to a site is not trusted, try one of these commands~~. ~~If you are trying to~~ verify ~~that an SSL certificate is installed correctly, be sure to check out the SSL Checker.~~

	~~=== Verify Public Key ===~~
	~~Check an MD5 hash of the public key to ensure that it matches with what is in a CSR or private key~~
	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
	# openssl x509 -noout -modulus -in certificate.crt \| openssl md5		# openssl x509 -noout -modulus -in certificate.crt \| openssl md5
Line 67:		Line 61:
	}}		}}

	=== ~~Viewing a~~ Remote Certificate ===		=== Remote Server Certificate ===
	All the certificates (including Intermediates) should be displayed when using {{code\|s_client}}.		All the certificates (including Intermediates) should be displayed when using {{code\|s_client}}.

			SNI allows virtual hosting of multiple domains on the same IP address. It is a mechanism that allows the web server to know which domain is being accessed in order to use the proper certificate when establishing a connection to the client. For websites that have been assigned a dedicated IP address, using SNI is not required.

	If the server is not using SNI:		If the server is not using SNI:
Line 80:		Line 76:
	}}		}}

	== ~~Converting Using OpenSSL ==~~		The x509 certificate can be retrieved in either case by piping the output through {{code\| openssl x509 -text}}.
			{{highlight\|lang=terminal\|code=
			# openssl s_client -showcerts -connect www.paypal.com:443 \| openssl x509 -text
			# openssl s_client -showcerts -servername www.paypal.com -connect www.paypal.com:443 \| openssl x509 -text
			}}

			== Certificate and Key Conversion ==
	These commands allow you to convert certificates and keys to different formats to make them compatible with specific types of servers or software. For example, you can convert a normal PEM file that would work with Apache to a PFX (PKCS#12) file and use it with Tomcat or IIS. Use our SSL Converter to convert certificates without messing with OpenSSL.		These commands allow you to convert certificates and keys to different formats to make them compatible with specific types of servers or software. For example, you can convert a normal PEM file that would work with Apache to a PFX (PKCS#12) file and use it with Tomcat or IIS. Use our SSL Converter to convert certificates without messing with OpenSSL.

Line 105:		Line 106:
	# openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt		# openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt
	}}		}}

Leo: /* Debugging Using OpenSSL */

2019-09-12T15:27:23Z

Debugging Using OpenSSL

← Older revision		Revision as of 15:27, 12 September 2019
Line 56:		Line 56:


	== ~~Debugging~~ Using OpenSSL ==		== Check Server SSL Certificate Using OpenSSL ==

	If you are receiving an error that the private doesn't match the certificate or that a certificate that you installed to a site is not trusted, try one of these commands. If you are trying to verify that an SSL certificate is installed correctly, be sure to check out the SSL Checker.		If you are receiving an error that the private doesn't match the certificate or that a certificate that you installed to a site is not trusted, try one of these commands. If you are trying to verify that an SSL certificate is installed correctly, be sure to check out the SSL Checker.

			=== Verify Public Key ===
	Check an MD5 hash of the public key to ensure that it matches with what is in a CSR or private key		Check an MD5 hash of the public key to ensure that it matches with what is in a CSR or private key
	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
Line 67:		Line 67:
	}}		}}

	~~Check an SSL connection.~~ All the certificates (including Intermediates) should be displayed		=== Viewing a Remote Certificate ===
			All the certificates (including Intermediates) should be displayed when using {{code\|s_client}}.

			If the server is not using SNI:
			{{highlight\|lang=terminal\|code=
			# openssl s_client -showcerts -connect www.paypal.com:443
			}}

			If the server is using SNI, you will need to provide the hostname:
	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
	# openssl s_client -connect www.paypal.com:443		# openssl s_client -showcerts -servername www.paypal.com -connect www.paypal.com:443
	}}		}}

Leo: introduction

2019-09-03T17:46:27Z

introduction

← Older revision		Revision as of 17:46, 3 September 2019
Line 1:		Line 1:
			OpenSSL allows you to create, modify, and view certificates and private keys. You can use it to generate [[Self Signed SSL Certificates]].

	== General OpenSSL Commands ==		== General OpenSSL Commands ==

	These commands allow you to generate CSRs, Certificates, Private Keys and do other miscellaneous tasks.		These commands allow you to generate CSRs, Certificates, Private Keys and do other miscellaneous tasks.

Leo: Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

2019-09-01T06:21:38Z

Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

← Older revision		Revision as of 06:21, 1 September 2019
Line 104:		Line 104:
	* [[Self Signed SSL Certificates]]		* [[Self Signed SSL Certificates]]

	[[Category:Linux]]~~{{Navbox Linux}}~~		{{Navbox Linux}}[[Category:Linux]]
	[[Category:LinuxUtilities]]		[[Category:LinuxUtilities]]
	[[Category:Certificates]]{{Navbox Certificates}}		[[Category:Certificates]]{{Navbox Certificates}}

Leo at 06:21, 1 September 2019

2019-09-01T06:21:26Z

← Older revision		Revision as of 06:21, 1 September 2019
Line 106:		Line 106:
	[[Category:Linux]]{{Navbox Linux}}		[[Category:Linux]]{{Navbox Linux}}
	[[Category:LinuxUtilities]]		[[Category:LinuxUtilities]]
			[[Category:Certificates]]{{Navbox Certificates}}