Error while converting pem encoded certificate to der using openssl

certificateopensslSecurityssl-certificatex509certificate

when I try to convert pem encoded certificate to der format , I am getting the below error.

openssl x509 -in test.cer -inform PEM -out output.crt -outform DER

**unable to load certificate300:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib.c:703:Expecting: TRUSTED CERTIFICATE**

Help would be appreciated !.

Link to download the Test.cer click to download

Best Answer

The example CER you've provided is not in a format OpenSSL will accept.

OpenSSL expects PEM formatted certificates to have a maximum line length of 64 characters so you'll need to add a line break after every 64th character. Additionally, you'll want to add -----BEGIN CERTIFICATE----- as the first line and -----END CERTIFICATE----- as the last line. At this point the OpenSSL CLI will allow you to parse and convert the file to DER.

Be sure those begin/end lines have five dashes to start/end them or else you'll still get errors.

With SNI

If the remote server is using SNI (that is, sharing multiple SSL hosts on a single IP address) you will need to send the correct hostname in order to get the right certificate.

openssl s_client -showcerts -servername www.example.com -connect www.example.com:443 </dev/null

Without SNI

If the remote server is not using SNI, then you can skip -servername parameter:

openssl s_client -showcerts -connect www.example.com:443 </dev/null

To view the full details of a site's cert you can use this chain of commands as well:

$ echo | \
    openssl s_client -servername www.example.com -connect www.example.com:443 2>/dev/null | \
    openssl x509 -text

Best Answer

Related Solutions

Android – “Debug certificate expired” error in Eclipse Android plugins

Linux – Using openssl to get the certificate from a server

With SNI

Without SNI

Related Topic