Error in converting crt certificate to pem

certificateopensslssl-certificate

I generated a CA certificate using easyRSA and I intend to use it with FreeRadius to use starttls, now I found that the FreeRadius uses pem format for certificates, but in my case the cert is in binary format, therefore I tried to use the following commands to convert my cert from crt it to pem format:

root@s1:/etc/freeradius/certs/easy-rsa/keys# openssl x509 -inform DER -in server.crt -out server.pem -text
unable to load certificate
3074016960:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1197:
3074016960:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:374:Type=X509

Second one:

root@s1:/etc/freeradius/certs/easy-rsa/keys# openssl x509 -in server.crt -inform DER -out server.pem -outform PEM
unable to load certificate
3073529536:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1197:
3073529536:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:374:Type=X509

But as seen I get always an error and I don't know why.

And here is my server.crt file:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=AT, ST=ST, L=Graz, O=Noureldin, OU=IT, CN=noureldin.local/name=Noureldin-CA/emailAddress=m.i.noureldin@gmail.com
        Validity
            Not Before: Jun 25 13:07:51 2016 GMT
            Not After : Jun 23 13:07:51 2026 GMT
        Subject: C=AT, ST=ST, L=Graz, O=Noureldin, OU=IT, CN=OpenVPN-Server/name=OpenVPN-Server/emailAddress=m.i.noureldin@gmail.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b6:c6:ec:91:f5:c8:23:8f:62:d4:14:18:04:fe:
                    b4:fd:5e:9b:47:11:07:52:45:fb:b9:8e:2f:55:c0:
                    f6:59:53:33:a1:56:4d:5d:61:c4:eb:b6:a6:67:9d:
                    e1:fd:68:b6:32:a8:d4:41:32:40:a3:16:59:8d:a3:
                    7f:63:b6:f4:bd:9d:5f:80:ba:ef:d4:94:c8:56:d0:
                    bc:2c:9c:03:cb:4c:b9:04:7e:d5:52:01:be:7b:c1:
                    d9:fb:80:3c:29:82:ff:52:89:47:2c:4a:e7:5d:6f:
                    3c:96:21:5c:bb:81:08:a3:27:34:11:f2:cb:c1:a2:
                    e5:00:e9:fb:97:d4:7e:df:76:17:02:5a:60:cc:80:
                    0d:de:2c:02:3a:16:a9:20:f4:8e:cc:96:23:83:81:
                    48:6b:5d:9e:be:49:20:d3:d8:05:63:cc:6a:ef:b2:
                    08:a3:0d:c7:06:23:7d:62:e7:ff:9d:b4:96:34:28:
                    b0:29:05:fa:4f:6b:1a:3f:df:5b:24:f3:26:4e:32:
                    33:8d:1a:72:25:00:36:d0:72:9e:5e:be:83:8c:d8:
                    46:22:e9:3b:04:58:03:a8:13:24:cd:45:76:58:de:
                    30:0d:36:ca:49:68:4b:c2:fc:c0:1e:e9:01:30:57:
                    6f:be:ef:9b:ed:77:e6:cc:17:1c:a5:9d:04:eb:2a:
                    69:ad
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Cert Type:
                SSL Server
            Netscape Comment:
                Easy-RSA Generated Server Certificate
            X509v3 Subject Key Identifier:
                7A:7C:1E:7D:E7:CA:91:20:F5:FC:E2:45:65:F9:67:D3:ED:E7:F9:87
            X509v3 Authority Key Identifier:
                keyid:AA:6F:06:92:CC:92:F9:09:B4:F9:32:05:9F:45:20:7D:3A:22:53:3B
                DirName:/C=AT/ST=ST/L=Graz/O=Noureldin/OU=IT/CN=noureldin.local/name=Noureldin-CA/emailAddress=m.i.noureldin@gmail.com
                serial:D2:5D:DB:1E:5B:AA:CC:BE

            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage:
                Digital Signature, Key Encipherment
            X509v3 Subject Alternative Name:
                DNS:server
    Signature Algorithm: sha256WithRSAEncryption
         32:16:8a:b9:30:4a:23:85:65:01:e4:1f:89:3d:14:f8:55:fb:
         90:a2:98:29:aa:83:e4:c1:d2:95:31:62:a9:61:2a:8a:bf:eb:
         18:8a:e0:3d:42:7e:35:2c:b9:11:eb:1c:f8:63:a1:e8:75:61:
         6c:40:76:4f:ae:21:c3:a8:c7:d2:70:c8:96:6b:cd:6a:89:d9:
         9e:34:d0:06:4c:10:c6:7b:bb:af:fa:bb:ea:14:82:21:f7:78:
         99:2f:88:c8:d0:1c:e6:1f:db:d5:00:d6:30:d1:54:72:db:c0:
         fa:4e:cf:ea:66:42:f2:c6:d3:ae:b5:c1:59:4c:ca:84:fc:80:
         28:63:5d:d7:5b:9d:22:98:d2:9b:10:5d:4d:99:d2:ee:9c:a2:
         13:75:fc:dc:95:9d:27:cc:df:f2:bd:89:5f:b4:43:f7:a8:f5:
         84:4c:bb:54:0d:ca:00:6e:cb:e1:21:a0:34:6d:7f:18:27:3c:
         0d:cf:b4:6a:c1:f0:ab:ed:63:df:d3:b5:cc:dd:d7:da:67:97:
         6f:53:10:22:43:c6:dc:5b:06:0e:88:44:24:03:d2:9a:8d:07:
         57:b0:19:cd:ce:6e:be:ef:bc:c2:69:8b:13:b6:7c:b5:c2:0c:
         a9:2a:08:e1:45:0d:42:37:c2:1f:e5:2b:d6:f0:26:72:f5:c0:
         43:83:f0:78
-----BEGIN CERTIFICATE-----
MIIFTTCCBDWgAwIBAgIBATANBgkqhkiG9w0BAQsFADCBozELMAkGA1UEBhMCQVQx
CzAJBgNVBAgTAlNUMQ0wCwYDVQQHEwRHcmF6MRIwEAYDVQQKEwlOb3VyZWxkaW4x
CzAJBgNVBAsTAklUMRgwFgYDVQQDEw9ub3VyZWxkaW4ubG9jYWwxFTATBgNVBCkT
DE5vdXJlbGRpbi1DQTEmMCQGCSqGSIb3DQEJARYXbS5pLm5vdXJlbGRpbkBnbWFp
bC5jb20wHhcNMTYwNjI1MTMwNzUxWhcNMjYwNjIzMTMwNzUxWjCBpDELMAkGA1UE
BhMCQVQxCzAJBgNVBAgTAlNUMQ0wCwYDVQQHEwRHcmF6MRIwEAYDVQQKEwlOb3Vy
ZWxkaW4xCzAJBgNVBAsTAklUMRcwFQYDVQQDEw5PcGVuVlBOLVNlcnZlcjEXMBUG
A1UEKRMOT3BlblZQTi1TZXJ2ZXIxJjAkBgkqhkiG9w0BCQEWF20uaS5ub3VyZWxk
aW5AZ21haWwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtsbs
kfXII49i1BQYBP60/V6bRxEHUkX7uY4vVcD2WVMzoVZNXWHE67amZ53h/Wi2MqjU
QTJAoxZZjaN/Y7b0vZ1fgLrv1JTIVtC8LJwDy0y5BH7VUgG+e8HZ+4A8KYL/UolH
LErnXW88liFcu4EIoyc0EfLLwaLlAOn7l9R+33YXAlpgzIAN3iwCOhapIPSOzJYj
g4FIa12evkkg09gFY8xq77IIow3HBiN9Yuf/nbSWNCiwKQX6T2saP99bJPMmTjIz
jRpyJQA20HKeXr6DjNhGIuk7BFgDqBMkzUV2WN4wDTbKSWhLwvzAHukBMFdvvu+b
7XfmzBccpZ0E6ypprQIDAQABo4IBhzCCAYMwCQYDVR0TBAIwADARBglghkgBhvhC
AQEEBAMCBkAwNAYJYIZIAYb4QgENBCcWJUVhc3ktUlNBIEdlbmVyYXRlZCBTZXJ2
ZXIgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFHp8Hn3nypEg9fziRWX5Z9Pt5/mHMIHY
BgNVHSMEgdAwgc2AFKpvBpLMkvkJtPkyBZ9FIH06IlM7oYGppIGmMIGjMQswCQYD
VQQGEwJBVDELMAkGA1UECBMCU1QxDTALBgNVBAcTBEdyYXoxEjAQBgNVBAoTCU5v
dXJlbGRpbjELMAkGA1UECxMCSVQxGDAWBgNVBAMTD25vdXJlbGRpbi5sb2NhbDEV
MBMGA1UEKRMMTm91cmVsZGluLUNBMSYwJAYJKoZIhvcNAQkBFhdtLmkubm91cmVs
ZGluQGdtYWlsLmNvbYIJANJd2x5bqsy+MBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsG
A1UdDwQEAwIFoDARBgNVHREECjAIggZzZXJ2ZXIwDQYJKoZIhvcNAQELBQADggEB
ADIWirkwSiOFZQHkH4k9FPhV+5CimCmqg+TB0pUxYqlhKoq/6xiK4D1CfjUsuRHr
HPhjoeh1YWxAdk+uIcOox9JwyJZrzWqJ2Z400AZMEMZ7u6/6u+oUgiH3eJkviMjQ
HOYf29UA1jDRVHLbwPpOz+pmQvLG0661wVlMyoT8gChjXddbnSKY0psQXU2Z0u6c
ohN1/NyVnSfM3/K9iV+0Q/eo9YRMu1QNygBuy+EhoDRtfxgnPA3PtGrB8KvtY9/T
tczd19pnl29TECJDxtxbBg6IRCQD0pqNB1ewGc3Obr7vvMJpixO2fLXCDKkqCOFF
DUI3wh/lK9bwJnL1wEOD8Hg=
-----END CERTIFICATE-----

I see that here at the buttom there is a pem format, does that mean that my crt file has both crt and pem format? so in that case can I just delete one of the parts and I will be able to convert it normally? (I know that doesn't make sense to delete a part just to convert it), because I am getting an error in tls initializing and I am not sure is the problem comes from the format of cert or from something else.

Could someone help me to solve that?

Best Answer

Your cert is already a PEM cert. If it doesn't get accepted make a copy, remove the certificate details above the -----BEGIN CERTIFICATE----- and try again.

Related Solutions

A Pem file and how does it differ from other OpenSSL Generated Key File Formats

SSL has been around for long enough you'd think that there would be agreed upon container formats. And you're right, there are. Too many standards as it happens. In the end, all of these are different ways to encode Abstract Syntax Notation 1 (ASN.1) formatted data — which happens to be the format x509 certificates are defined in — in machine-readable ways.

.csr - This is a Certificate Signing Request. Some applications can generate these for submission to certificate-authorities. The actual format is PKCS10 which is defined in RFC 2986. It includes some/all of the key details of the requested certificate such as subject, organization, state, whatnot, as well as the public key of the certificate to get signed. These get signed by the CA and a certificate is returned. The returned certificate is the public certificate (which includes the public key but not the private key), which itself can be in a couple of formats.
.pem - Defined in RFC 1422 (part of a series from 1421 through 1424) this is a container format that may include just the public certificate (such as with Apache installs, and CA certificate files /etc/ssl/certs), or may include an entire certificate chain including public key, private key, and root certificates. Confusingly, it may also encode a CSR (e.g. as used here) as the PKCS10 format can be translated into PEM. The name is from Privacy Enhanced Mail (PEM), a failed method for secure email but the container format it used lives on, and is a base64 translation of the x509 ASN.1 keys.
.key - This is a (usually) PEM formatted file containing just the private-key of a specific certificate and is merely a conventional name and not a standardized one. In Apache installs, this frequently resides in /etc/ssl/private. The rights on these files are very important, and some programs will refuse to load these certificates if they are set wrong.
.pkcs12 .pfx .p12 - Originally defined by RSA in the Public-Key Cryptography Standards (abbreviated PKCS), the "12" variant was originally enhanced by Microsoft, and later submitted as RFC 7292. This is a password-protected container format that contains both public and private certificate pairs. Unlike .pem files, this container is fully encrypted. Openssl can turn this into a .pem file with both public and private keys: openssl pkcs12 -in file-to-convert.p12 -out converted-file.pem -nodes

A few other formats that show up from time to time:

.der - A way to encode ASN.1 syntax in binary, a .pem file is just a Base64 encoded .der file. OpenSSL can convert these to .pem (openssl x509 -inform der -in to-convert.der -out converted.pem). Windows sees these as Certificate files. By default, Windows will export certificates as .DER formatted files with a different extension. Like...
.cert .cer .crt - A .pem (or rarely .der) formatted file with a different extension, one that is recognized by Windows Explorer as a certificate, which .pem is not.
.p7b .keystore - Defined in RFC 2315 as PKCS number 7, this is a format used by Windows for certificate interchange. Java understands these natively, and often uses .keystore as an extension instead. Unlike .pem style certificates, this format has a defined way to include certification-path certificates.
.crl - A certificate revocation list. Certificate Authorities produce these as a way to de-authorize certificates before expiration. You can sometimes download them from CA websites.

In summary, there are four different ways to present certificates and their components:

PEM - Governed by RFCs, used preferentially by open-source software because it is text-based and therefore less prone to translation/transmission errors. It can have a variety of extensions (.pem, .key, .cer, .cert, more)
PKCS7 - An open standard used by Java and supported by Windows. Does not contain private key material.
PKCS12 - A Microsoft private standard that was later defined in an RFC that provides enhanced security versus the plain-text PEM format. This can contain private key and certificate chain material. Its used preferentially by Windows systems, and can be freely converted to PEM format through use of openssl.
DER - The parent format of PEM. It's useful to think of it as a binary version of the base64-encoded PEM file. Not routinely used very much outside of Windows.

I hope this helps.

Ssl – how to download the ssl certificate from a website

In order to download the certificate, you need to use the client built into openssl like so:

echo -n | openssl s_client -connect $HOST:$PORTNUMBER -servername $SERVERNAME \
    | openssl x509 > /tmp/$SERVERNAME.cert

That will save the certificate to /tmp/$SERVERNAME.cert.

The -servername is used to select the correct certificate when multiple are presented, in the case of SNI.

You can use -showcerts if you want to download all the certificates in the chain. But if you just want to download the server certificate, there is no need to specify -showcerts. The x509 at the end will strip out the intermediate certs, you will need to use sed -n '/-----BEGIN/,/-----END/p' instead of the x509 at the end.

echo -n gives a response to the server, so that the connection is released

openssl x509 removes information about the certificate chain and connection details. This is the preferred format to import the certificate into other keystores.

Best Answer

Related Solutions

A Pem file and how does it differ from other OpenSSL Generated Key File Formats

Ssl – how to download the ssl certificate from a website

Related Topic