Bureaucrats, confirmed, Administrators
4,558
edits
Changes
Created page with "When dealing with "SSL" (or more appropriately TLS) certificates, you'll encounter .pem .crt .cer .key .der files. So, what's the difference? There are four basic types of c..."
When dealing with "SSL" (or more appropriately TLS) certificates, you'll encounter .pem .crt .cer .key .der files. So, what's the difference?
There are four basic types of certificate manipulations. View, Transform, Combination , and Extraction
.der encoded certificates are binary, so to view them, you use a slightly modified command: <code>openssl x509 -in mycert.der -inform der -text -noout</code> <ref>http://www.gtopia.org/blog/2010/02/der-vs-crt-vs-cer-vs-pem-certificates/</ref>
== View a Certificate ==
<source lang="bash">
openssl x509 -in /etc/haproxy/certs/wiki.freephile.org.pem -text -noout
</source>
<pre>
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
03:10:47:5a:ec:82:08:e3:ec:30:7e:dc:dc:45:a7:93:8e:62
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Validity
Not Before: Apr 24 13:29:01 2018 GMT
Not After : Jul 23 13:29:01 2018 GMT
Subject: CN=wiki.freephile.org
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:b5:b3:aa:e4:59:5b:3e:dd:1f:b4:85:83:f0:41:
82:7e:85:df:7f:ae:32:44:1f:2e:e4:0d:05:4b:73:
0f:39:e2:5b:7e:f7:f5:3c:64:c2:fe:6e:fe:4c:e3:
73:62:bc:89:7e:8c:4b:0e:b6:66:e1:c2:e0:a7:d8:
d5:af:14:51:de:62:73:34:6b:be:07:0f:c3:78:dd:
6a:c6:91:ad:3d:d7:8d:1f:61:26:3d:6c:1d:41:b1:
e0:7c:d4:87:4a:f7:29:35:43:ac:e9:47:19:f7:d3:
4e:5d:91:4b:1b:62:f5:49:71:fd:b8:e8:86:ae:35:
07:27:3d:60:44:c4:c8:76:f7:1a:d7:e3:1c:d4:a3:
8a:1e:66:68:d6:78:2f:6e:7b:43:30:09:4a:78:57:
32:10:1c:c7:01:69:2a:3a:18:ad:b5:bb:7a:3e:6e:
0c:24:4e:27:42:a7:87:31:20:0f:b8:d5:06:b1:f1:
8a:cd:48:47:88:9e:50:12:ec:a1:59:d7:6d:12:cf:
8e:6b:da:aa:59:4a:46:5f:b6:d1:19:72:1d:ee:c1:
88:eb:6b:a2:2e:e4:d3:81:90:4c:9f:f1:06:56:43:
a4:7d:07:a7:03:c7:3b:3d:85:a8:39:9a:cf:c6:2c:
ac:54:07:9d:65:c7:19:39:e8:73:2d:e5:f9:eb:f7:
c3:af
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Key Identifier:
CE:85:E6:59:F4:D5:75:F8:C0:2A:35:4C:6F:5E:81:C3:C3:74:97:C9
X509v3 Authority Key Identifier:
keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1
Authority Information Access:
OCSP - URI:http://ocsp.int-x3.letsencrypt.org
CA Issuers - URI:http://cert.int-x3.letsencrypt.org/
X509v3 Subject Alternative Name:
DNS:meta.qualitybox.us, DNS:wiki.freephile.org
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
CPS: http://cps.letsencrypt.org
User Notice:
Explicit Text: This Certificate may only be relied upon by Relying Parties and only in accordance with the Certificate Policy found at https://letsencrypt.org/repository/
CT Precertificate SCTs:
Signed Certificate Timestamp:
Version : v1(0)
Log ID : DB:74:AF:EE:CB:29:EC:B1:FE:CA:3E:71:6D:2C:E5:B9:
AA:BB:36:F7:84:71:83:C7:5D:9D:4F:37:B6:1F:BF:64
Timestamp : Apr 24 14:29:01.244 2018 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:44:02:20:2D:74:0F:F3:8F:87:D9:40:92:2B:43:C7:
A8:FE:77:87:D6:86:26:B4:AD:76:28:46:DA:AA:84:E9:
59:C5:F5:68:02:20:55:BE:CC:46:BC:85:40:8C:B4:BD:
2C:53:04:06:88:5B:93:34:10:A3:6D:B9:D9:59:4E:5C:
63:FC:FA:EC:64:4B
Signed Certificate Timestamp:
Version : v1(0)
Log ID : 29:3C:51:96:54:C8:39:65:BA:AA:50:FC:58:07:D4:B7:
6F:BF:58:7A:29:72:DC:A4:C3:0C:F4:E5:45:47:F4:78
Timestamp : Apr 24 14:29:01.274 2018 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:45:02:20:27:6A:87:41:B2:05:76:33:03:FD:8C:25:
FD:0A:18:4D:2B:74:FE:33:D3:43:66:33:A1:33:91:85:
2B:45:44:B6:02:21:00:DA:0A:CC:4F:C3:CF:EE:53:8C:
4C:B8:8B:64:40:39:C9:3F:13:2D:D1:44:22:CC:E1:B6:
B6:C1:3F:3F:D4:23:39
Signature Algorithm: sha256WithRSAEncryption
96:14:50:89:03:22:c4:48:0f:1a:25:55:4a:26:70:3e:28:3b:
86:58:60:08:d1:ce:bf:01:d6:53:72:bf:b2:fc:90:6f:62:74:
ae:a5:7b:a1:77:77:6f:c4:96:41:0a:7a:92:e2:ba:8c:4e:38:
f0:e2:b5:fb:5e:62:db:fb:b8:a9:66:25:cf:af:5c:c5:d9:0c:
5e:c8:8d:f5:69:a3:32:2a:58:0e:30:1c:ca:60:3b:54:12:56:
71:d9:b2:fc:c2:55:a6:cf:6f:61:af:79:60:85:29:37:9f:80:
eb:da:26:a0:5a:38:55:41:bd:16:92:03:7e:b9:a3:8b:ef:47:
4e:86:1f:bf:11:85:35:0f:99:58:4c:d8:9d:c0:59:72:bc:cf:
d7:6d:75:96:e8:94:21:0d:43:38:ab:b1:e9:1a:90:f2:d9:24:
da:93:e0:cd:8f:d4:69:d1:9b:1e:c1:60:b0:c8:fa:aa:11:2e:
36:49:92:b3:9f:df:9a:91:43:41:4f:1f:d0:49:c5:17:ce:ac:
a6:4b:13:9d:cb:a7:f0:59:32:72:81:a0:5a:07:72:fb:93:72:
57:11:d8:eb:61:3e:34:09:38:e9:41:a8:d3:d9:59:ee:e9:c5:
4b:c5:3f:9b:4e:94:ef:eb:72:21:a0:40:c3:5b:65:26:61:ec:
25:02:52:01
</pre>
[[Category:Security]]
There are four basic types of certificate manipulations. View, Transform, Combination , and Extraction
.der encoded certificates are binary, so to view them, you use a slightly modified command: <code>openssl x509 -in mycert.der -inform der -text -noout</code> <ref>http://www.gtopia.org/blog/2010/02/der-vs-crt-vs-cer-vs-pem-certificates/</ref>
== View a Certificate ==
<source lang="bash">
openssl x509 -in /etc/haproxy/certs/wiki.freephile.org.pem -text -noout
</source>
<pre>
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
03:10:47:5a:ec:82:08:e3:ec:30:7e:dc:dc:45:a7:93:8e:62
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
Validity
Not Before: Apr 24 13:29:01 2018 GMT
Not After : Jul 23 13:29:01 2018 GMT
Subject: CN=wiki.freephile.org
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:b5:b3:aa:e4:59:5b:3e:dd:1f:b4:85:83:f0:41:
82:7e:85:df:7f:ae:32:44:1f:2e:e4:0d:05:4b:73:
0f:39:e2:5b:7e:f7:f5:3c:64:c2:fe:6e:fe:4c:e3:
73:62:bc:89:7e:8c:4b:0e:b6:66:e1:c2:e0:a7:d8:
d5:af:14:51:de:62:73:34:6b:be:07:0f:c3:78:dd:
6a:c6:91:ad:3d:d7:8d:1f:61:26:3d:6c:1d:41:b1:
e0:7c:d4:87:4a:f7:29:35:43:ac:e9:47:19:f7:d3:
4e:5d:91:4b:1b:62:f5:49:71:fd:b8:e8:86:ae:35:
07:27:3d:60:44:c4:c8:76:f7:1a:d7:e3:1c:d4:a3:
8a:1e:66:68:d6:78:2f:6e:7b:43:30:09:4a:78:57:
32:10:1c:c7:01:69:2a:3a:18:ad:b5:bb:7a:3e:6e:
0c:24:4e:27:42:a7:87:31:20:0f:b8:d5:06:b1:f1:
8a:cd:48:47:88:9e:50:12:ec:a1:59:d7:6d:12:cf:
8e:6b:da:aa:59:4a:46:5f:b6:d1:19:72:1d:ee:c1:
88:eb:6b:a2:2e:e4:d3:81:90:4c:9f:f1:06:56:43:
a4:7d:07:a7:03:c7:3b:3d:85:a8:39:9a:cf:c6:2c:
ac:54:07:9d:65:c7:19:39:e8:73:2d:e5:f9:eb:f7:
c3:af
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Key Identifier:
CE:85:E6:59:F4:D5:75:F8:C0:2A:35:4C:6F:5E:81:C3:C3:74:97:C9
X509v3 Authority Key Identifier:
keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1
Authority Information Access:
OCSP - URI:http://ocsp.int-x3.letsencrypt.org
CA Issuers - URI:http://cert.int-x3.letsencrypt.org/
X509v3 Subject Alternative Name:
DNS:meta.qualitybox.us, DNS:wiki.freephile.org
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
Policy: 1.3.6.1.4.1.44947.1.1.1
CPS: http://cps.letsencrypt.org
User Notice:
Explicit Text: This Certificate may only be relied upon by Relying Parties and only in accordance with the Certificate Policy found at https://letsencrypt.org/repository/
CT Precertificate SCTs:
Signed Certificate Timestamp:
Version : v1(0)
Log ID : DB:74:AF:EE:CB:29:EC:B1:FE:CA:3E:71:6D:2C:E5:B9:
AA:BB:36:F7:84:71:83:C7:5D:9D:4F:37:B6:1F:BF:64
Timestamp : Apr 24 14:29:01.244 2018 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:44:02:20:2D:74:0F:F3:8F:87:D9:40:92:2B:43:C7:
A8:FE:77:87:D6:86:26:B4:AD:76:28:46:DA:AA:84:E9:
59:C5:F5:68:02:20:55:BE:CC:46:BC:85:40:8C:B4:BD:
2C:53:04:06:88:5B:93:34:10:A3:6D:B9:D9:59:4E:5C:
63:FC:FA:EC:64:4B
Signed Certificate Timestamp:
Version : v1(0)
Log ID : 29:3C:51:96:54:C8:39:65:BA:AA:50:FC:58:07:D4:B7:
6F:BF:58:7A:29:72:DC:A4:C3:0C:F4:E5:45:47:F4:78
Timestamp : Apr 24 14:29:01.274 2018 GMT
Extensions: none
Signature : ecdsa-with-SHA256
30:45:02:20:27:6A:87:41:B2:05:76:33:03:FD:8C:25:
FD:0A:18:4D:2B:74:FE:33:D3:43:66:33:A1:33:91:85:
2B:45:44:B6:02:21:00:DA:0A:CC:4F:C3:CF:EE:53:8C:
4C:B8:8B:64:40:39:C9:3F:13:2D:D1:44:22:CC:E1:B6:
B6:C1:3F:3F:D4:23:39
Signature Algorithm: sha256WithRSAEncryption
96:14:50:89:03:22:c4:48:0f:1a:25:55:4a:26:70:3e:28:3b:
86:58:60:08:d1:ce:bf:01:d6:53:72:bf:b2:fc:90:6f:62:74:
ae:a5:7b:a1:77:77:6f:c4:96:41:0a:7a:92:e2:ba:8c:4e:38:
f0:e2:b5:fb:5e:62:db:fb:b8:a9:66:25:cf:af:5c:c5:d9:0c:
5e:c8:8d:f5:69:a3:32:2a:58:0e:30:1c:ca:60:3b:54:12:56:
71:d9:b2:fc:c2:55:a6:cf:6f:61:af:79:60:85:29:37:9f:80:
eb:da:26:a0:5a:38:55:41:bd:16:92:03:7e:b9:a3:8b:ef:47:
4e:86:1f:bf:11:85:35:0f:99:58:4c:d8:9d:c0:59:72:bc:cf:
d7:6d:75:96:e8:94:21:0d:43:38:ab:b1:e9:1a:90:f2:d9:24:
da:93:e0:cd:8f:d4:69:d1:9b:1e:c1:60:b0:c8:fa:aa:11:2e:
36:49:92:b3:9f:df:9a:91:43:41:4f:1f:d0:49:c5:17:ce:ac:
a6:4b:13:9d:cb:a7:f0:59:32:72:81:a0:5a:07:72:fb:93:72:
57:11:d8:eb:61:3e:34:09:38:e9:41:a8:d3:d9:59:ee:e9:c5:
4b:c5:3f:9b:4e:94:ef:eb:72:21:a0:40:c3:5b:65:26:61:ec:
25:02:52:01
</pre>
[[Category:Security]]