Umwandeln von Zertifikaten

Umwandlung von pem in PKCS12 Format

Mit CA certifikat

• openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile ca.crt -out cred.p12

Ohne CA certifikat

• openssl pkcs12 -export -in cert.pem -inkey key.pem -out cred.p12

Umwandlung von PKCS12 ins pem Format

Um Windows Zertifikate unter Linux/openssl verwenden zu können, müssen aus der keyfile.p12-Datei die x509 Zertifikate exportiert werden.

• openssl pkcs12 -clcerts -nokeys -out cert.pem -in cert.p12
• openssl pkcs12 -cacerts -nokeys -out root.pem -in cert.p12
• openssl pkcs12 -nocerts -out private-key.pem -in cert.p12

Jetzt können diese wieder verwendet werden.==

• openssl x509 -text -noout -md5 -in private-key.pem
• openssl x509 -text -noout -md5 -in root.pem
• openssl x509 -text -noout -md5 -in cert.pem

pkcs12 Container entpacken

Ca.crt

root@hutze:~/p12# openssl pkcs12  -cacerts -nomacver -nokeys -in <pkcs12-datei> -out <ca.crt> 

Client.crt

root@hutze:~/p12# openssl pkcs12 -clcerts -nomacver -nokeys -in <pkcs12-datei> -out <client.crt> 

Client.key

root@hutze:~/p12# openssl pkcs12  -nocerts -nodes -nomacver -in <pkcs12-datei> -out <client.key>

Script

#!/bin/bash
if test "$#" -eq "2"
then  
 openssl pkcs12 -in $1 -cacerts -nomacver -nokeys -out ca.crt     -password pass:"$2"
 openssl pkcs12 -in $1 -clcerts -nomacver -nokeys -out client.crt -password pass:"$2" 
 openssl pkcs12 -in $1 -nocerts -nodes -nomacver -out  client.key -password pass:"$2"
else
 echo "$0 <dat.p12> <password>"
fi

reqext in $CLIENT.cnf

[ server-ext ]
extendedKeyUsage = serverAuth, 1.3.6.1.5.5.8.2.2
subjectAltName = DNS:huey.xinux.org

request

openssl req -new -key ${CLIENT}.key -out ${CLIENT}.csr -config ${CLIENT}.cnf -reqexts server-ext

show

openssl req -text -noout -in huey.xinux.org.csr | grep -A 4 "Requested Extensions"

        Requested Extensions:
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            X509v3 Subject Alternative Name: 
                DNS:huey.xinux.org

sign

openssl x509 -CA ca.crt -CAkey ca.key -CAserial serial -sha1 -in $COMMON_NAME.csr -req -out $COMMON_NAME.crt -extfile $COMMON_NAME.cnf -extensions server-ext

show

openssl x509 -noout -text -in huey.xinux.org.crt

openssl x509 -noout -text -in huey.xinux.org.crt  | grep -A 4 "X509v3 extensions"
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            X509v3 Subject Alternative Name: 
                DNS:huey.xinux.org