|
Size: 3026
Comment: Remove line numbers
|
Size: 3436
Comment: Change 'blah' to '$DOMAIN' for easier copying & pasting
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 5: | Line 5: |
| == Poor man's benchmark == Quick way to compare processing power of CPUs. {{{#!highlight sh numbers=off openssl speed sha1 }}} |
|
| Line 8: | Line 16: |
| openssl req -nodes -new -keyout blah.key.pem -out blah.req.pem | # Create a key at the same time openssl req -nodes -new -keyout $DOMAIN.key.pem -out $DOMAIN.csr.pem # Use an existing key openssl req -nodes -new -key $DOMAIN.key.pem -out $DOMAIN.csr.pem |
| Line 11: | Line 22: |
| blah.key.pem will act as an `SSLCertificateKeyFile` for mod_ssl in Apache | $DOMAIN.key.pem will act as an `SSLCertificateKeyFile` for mod_ssl in Apache. |
| Line 16: | Line 27: |
| openssl x509 -subject -dates -fingerprint -in blah.key.pem | openssl x509 -subject -dates -fingerprint -in $DOMAIN.key.pem |
| Line 22: | Line 33: |
| openssl genrsa -out blah.key.pem | openssl genrsa -out $DOMAIN.key.pem |
| Line 28: | Line 39: |
| openssl x509 -in blah.crt.pem -noout -text | # For a certificate signing request openssl req -text -noout -in $DOMAIN.csr.pem # For a generated certificate openssl x509 -in $DOMAIN.crt.pem -noout -text |
| Line 34: | Line 48: |
| cat blah.key.pem blah.crt.pem blah.dhp.pem > blah.pem | cat $DOMAIN.key.pem $DOMAIN.crt.pem $DOMAIN.dhp.pem > $DOMAIN.pem |
| Line 42: | Line 56: |
| openssl pkcs12 -export -in blah.crt.pem -inkey blah.key.pem -out blah.p12 -name "Bill Gates" | openssl pkcs12 -export -in $DOMAIN.crt.pem -inkey $DOMAIN.key.pem -out blah.p12 -name "Bill Gates" |
| Line 50: | Line 64: |
| openssl smine -sign -in msg.txt -text -out msg.encrypted -signer blah.crt.pem -inkey blah.key.pem | openssl smine -sign -in msg.txt -text -out msg.encrypted -signer $DOMAIN.crt.pem -inkey $DOMAIN.key.pem |
| Line 74: | Line 88: |
| openssl ca -revoke blah.crt.pem | openssl ca -revoke $DOMAIN.crt.pem |
| Line 80: | Line 94: |
| openssl ca -gencrl -out crl/hotnudiegirls.com-CA.crl | openssl ca -gencrl -out crl/$DOMAIN-CA.crl |
| Line 86: | Line 100: |
| openssl ca -out blah.crt.pem -in blah.req.pem | openssl ca -out blah.crt.pem -in $DOMAIN.req.pem |
| Line 94: | Line 108: |
| openssl dhparam -out hotnudiegirls.com-CA.dhp.pem 1536 | openssl dhparam -out $DOMAIN-CA.dhp.pem 1536 |
| Line 100: | Line 114: |
| openssl req -new -x509 -key blah.key.pem -out blah.crt.pem | openssl req -new -x509 -key $DOMAIN.key.pem -out $DOMAIN.crt.pem |
End-user stuff
Poor man's benchmark
Quick way to compare processing power of CPUs.
openssl speed sha1
Create certificate request/unsigned key
# Create a key at the same time
openssl req -nodes -new -keyout $DOMAIN.key.pem -out $DOMAIN.csr.pem
# Use an existing key
openssl req -nodes -new -key $DOMAIN.key.pem -out $DOMAIN.csr.pem
$DOMAIN.key.pem will act as an SSLCertificateKeyFile for mod_ssl in Apache.
Show key fingerprint
openssl x509 -subject -dates -fingerprint -in $DOMAIN.key.pem
Generate key
openssl genrsa -out $DOMAIN.key.pem
Display certificate information
# For a certificate signing request
openssl req -text -noout -in $DOMAIN.csr.pem
# For a generated certificate
openssl x509 -in $DOMAIN.crt.pem -noout -text
Creating a PEM file for servers
cat $DOMAIN.key.pem $DOMAIN.crt.pem $DOMAIN.dhp.pem > $DOMAIN.pem
Used by courier-imap, etc.
Creating a PKCS12-format file
openssl pkcs12 -export -in $DOMAIN.crt.pem -inkey $DOMAIN.key.pem -out blah.p12 -name "Bill Gates"
Used for creating certificates used in e-mail clients and web browsers
Signing e-mails
openssl smine -sign -in msg.txt -text -out msg.encrypted -signer $DOMAIN.crt.pem -inkey $DOMAIN.key.pem
Certificate Authority stuff
When setting up a new CA on a system, make sure index.txt and serial exist (empty and set to 01, respectively), and create directories private and newcert. Edit openssl.cnf - change default_days, certificate and private_key, possibly key size (1024, 1280, 1536, 2048) to whatever is desired.
Create CA certificate
openssl req -new -x509 -keyout private/something-CA.key.pem -out ./something-CA.crt.pem -days 3650
Export CA certificate in DER format
openssl x509 -in something-CA.crt.pem -outform der -out something-CA.crt
Used by web browsers.
Revoke certificate
openssl ca -revoke $DOMAIN.crt.pem
Generate Certificate Revocation List (CRL)
openssl ca -gencrl -out crl/$DOMAIN-CA.crl
Sign Certificate Request
openssl ca -out blah.crt.pem -in $DOMAIN.req.pem
blah.crt.pem acts as SSLCertificateFile for Apache
Create Diffie-Hoffman Parameters for Current CA
openssl dhparam -out $DOMAIN-CA.dhp.pem 1536
Create self-signed certificate from generated key
openssl req -new -x509 -key $DOMAIN.key.pem -out $DOMAIN.crt.pem
Use only when you've no CA and will only be generating one key/certificate (useless for anything that requires signed certificates on both ends)
Command-line tricks
Simple file encryption
openssl enc -bf -A -in file_to_encrypt.txt
Simple file decryption
openssl enc -bf -d -A -in file_to_encrypt.txt
