In this article I'm going to explain how to create keys, SSL certificates and key stores. This can be required to simply migrate your website to HTTPS or to enable single sign-on authentication or in other cases. SSL certificates can be used for digital signing/verification and for encryption/decryption.
In case of digital signatures, the sender signs the message using a private key certificate, while the receiver verifies the signature of the message using the public key certificate.
In case of encryption, the sender encrypts the message using the public key certificate, while the receiver decrypts the message using the private key.
Generating keys
The first step is generating a private/public key pair. This can be done in different ways. We'll use openssl utility as it will be used for certificates later as well. The important point is the key length - bigger length makes the key harder to crack. It's considered safe to have the length of at least 2048 bits for RSA keys nowadays.
- Generate RSA private key of 2048 bits in PEM format
- Generate the public key in DER format
- Generate the unencrypted private key in PKCS #8 and DER format
openssl genrsa -out rsaprivkey.pem 2048
openssl rsa -in rsaprivkey.pem -pubout -outform DER -out rsapubkey.der
openssl pkcs8 -topk8 -inform PEM -outform DER -in rsaprivkey.pem -out rsaprivkey.der -nocrypt
Generating certificates
You have two options - generating a self signed certificate or requesting a trusted certificate from a certificate authority. While self signed certificates can be acceptable during development, any production system will require a trusted certificate. Both options are mentioned here.
- Generate certificate signing request (CSR), in the "Common Name" set the hostname of your website
- Print CSR details
- Generate self signed certificate
- Request a trusted certificate (e.g. Let's Encrypt or COMODO)
openssl req -new -key rsaprivkey.pem -out server.csr
openssl req -in server.csr -noout -textExample output:
Certificate Request: Data: Version: 0 (0x0) Subject: C=AU, ST=Some-State, O=Internet Widgits Pty Ltd Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:d2:02:4a:83:b1:07:4c:9f:b3:40:11:88:73:16: ... more HEX data ... Exponent: 65537 (0x10001) Attributes: a0:00 Signature Algorithm: sha256WithRSAEncryption 28:f6:2e:1b:f7:4b:d9:fd:96:58:e5:ca:86:87:07:a2:a7:21: ... more HEX data ...
openssl x509 -req -days 365 -in server.csr -signkey rsaprivkey.pem -out server.crtExample output:
Signature ok subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd Getting Private key
There are two main encoding formats that a certificate can be stored in - a binary DER format (can also have file extensions CER or CRT) and a Base64 encoded PEM format which syntax is defined by X.509 standards (can also have file extension CRT). You can convert between the encoding formats using the following commands:
- Convert certificate from DER to PEM format
- Convert certificate from PEM to DER format
openssl x509 -inform der -in certificate.crt -out certificate.pem
openssl x509 -outform der -in certificate.pem -out certificate.crt
Working with keystores
There are different types of keystores. The most common types are PKCS #12 (using extensions .p12 or .pfx) and JKS (Java KeyStore, specific to Java language). We'll use keytool Java utility to work with JKS files.
- Generate a PKCS12 keystore with our certificate (note - set non-empty password)
- Convert PKCS12 keystore to JKS keystore
- Generate an empty JKS keystore (note - set non-empty password)
- Import certificate from PKCS12 to JKS keystore
- Import a trusted DER certificate into JKS keystore
- Check certificates in JKS keystore
openssl pkcs12 -export -in server.crt -inkey rsaprivkey.pem -name server -out server.p12
Next you can either convert PKCS12 keystore type into JKS or generate an empty JKS keystore and import a certificate there. Both options are explained below.
keytool -importkeystore -srckeystore server.p12 -srcstoretype pkcs12 -srcalias server -destkeystore server.jks -deststoretype jks -deststorepass password -destalias server
keytool -genkey -alias server -keystore server.jks keytool -delete -alias server -keystore server.jks
keytool -importkeystore -deststorepass password -destkeystore server.jks -srckeystore server.p12 -srcstoretype PKCS12
Now when you have a JKS keystore with your private certificate, you might need to import a public trusted certificate there as well. For example, this can be needed to enable SAML SSO authentication.
keytool -import -trustcacerts -alias trustedCert -file trustedCert.crt -keystore server.jks
keytool -list -keystore server.jks -storepass passwordExample output:
Keystore type: JKS Keystore provider: SUN Your keystore contains 2 entries server, 27-Jul-2017, PrivateKeyEntry, Certificate fingerprint (SHA1): A3:11:78:7C:D7:C6:30:F9:57:DF:3C:B1:B4:C9:1F:06:83:E5:ED:39 trustedCert, 24-Jul-2017, trustedCertEntry, Certificate fingerprint (SHA1): B8:4D:C8:5F:1C:98:A3:0B:F2:BC:04:E0:A3:22:26:66:64:F7:60:C8
Comments
Post a Comment