Concatenated PEM File – Split Private Key and Certificate Chain

opensslssl-certificate

I have a .pem file with SSL private key and certificate chain for my web-server concatenated into a single file. The file is in following structure:

-----BEGIN PRIVATE KEY-----
...data...
-----END PRIVATE KEY-----

-----BEGIN CERTIFICATE-----
...data...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...data...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...data...
-----END CERTIFICATE-----

What commands I use to split it to have separate files private.key and fullchain.pem?

Best Answer

Assuming the input file your-file.pem contains only 1 private key and corresponding chain of certificates.

Extract private key:

openssl storeutl -keys your-file.pem > private.key

Extract fullchain certificates:

openssl storeutl -certs your-file.pem > fullchain.pem

If the certificate data comes from standard input, use /dev/stdin :

cat your-file.pem | openssl storeutl -keys /dev/stdin
cat your-file.pem | openssl storeutl -certs /dev/stdin

Use the following OpenSSL command:

openssl pkcs12 -export -out "output.pfx" -inkey "Unencrypted_Private_Key.pem"
-in  "Issued_Certificate.cer" -certfile CACert.crt

The certificate and key files are just text files with .cer and .pem extensions, respectively.

How to decrypt an encrypted private key:

openssl rsa -in "Encrypted_Private_Key.pem" -out "Decrypted_Private_Key.pem"

See more OpenSSL commands and this helpful online SSL tool.

If your PFX file was created correctly, but you receive an error like "Connection Interrupted" when browsing SSL on your website after installing the certificate, try rebooting the server. It has worked for me in the past. If it doesn't, your private key probably does not match your certificate.

Ssl – In Stud, which Private RSA Key should be concatenated in the x509 SSL certificate pem file to avoid “self-signed” browser warning

SSL X509 certificate file is a file containing a certificate in the format specified by the ITU in their X series of specifications - specifically x.509. There is no private-key information there as it is a certificate format so things like names, public keys, signatures, validity dates and other goodies go in there - but not private-keys.

PEM is a set of specifications for Privacy Enhanced Mail - it offers for the most part packaging standards that are build off of the PKCS specs (PKCS specs were developed by RSA and RSA labs themselves for public use to enable interoperability between various implementations - this was done again by the IETF and by the community in other arenas). You can use openssl to convert formats around - see here http://www.openssl.org/docs/apps/openssl.html . Concatenation won't help you any.

If the certificate is self-signed then it's kind of odd that a CA gave it to you - that makes me think that you are telling about feeding the Gandi CA certificate to openssl which is telling you that cert is self signed (ergo it is a root or end entity certificate but certainly not an intermediate aka chain certificate).

To address some of your points: 1 Self signed certs will always generate warnings in good clients because they lack trust until the user decides they are trustworthy (or for most users.. until Microsoft , Mozilla Foundation, Google, or Opera) decides the user should trust that CA). If your clients (browsers or whatever) have the CA stored and marked as trusted then this warning won't pop-up. 2 Possibly 3 Looks like you used the right key and CSR with Gandi 4 Looks to me like you need to load the domain key and cert and possibly CA into OpenSSL either via OS level trust configuration or via Stud configuration.

Best Answer

Related Solutions

IIS – How to Import SSL Certificate with Text and Private Key

Use the following OpenSSL command:

How to decrypt an encrypted private key:

Ssl – In Stud, which Private RSA Key should be concatenated in the x509 SSL certificate pem file to avoid “self-signed” browser warning

Related Topic