SSL different file formats

In my last blog we have created files with different extensions like .crt, .csr, .der

So now what are these formats?

These are the standard file formats using different standards:

CSR(.csr)

This is a Certificate Signing Request. Some applications can generate these for submission to certificate-authorities. The actual format is PKCS10 which is defined in RFC 2986. It includes some/all of the key details of the requested certificate such as subject, organization, state, whatnot, as well as the public key of the certificate to get signed. These get signed by the CA and a certificate is returned. The returned certificate is the public certificate (not the key), which itself can be in a couple of formats.

PEM(.pem) 

Defined in RFC's 1421 through 1424, this is a container format that may include just the public certificate (such as with Apache installs, and CA certificate files /etc/ssl/certs), or may include an entire certificate chain including public key, private key, and root certificates. The name is from Privacy Enhanced Email, a failed method for secure email but the container format it used lives on, and is a base64 translation of the x509 ASN.1 keys.

KEY(.key) 

This is a PEM formatted file containing just the private-key of a specific certificate and is merely a conventional name and not a standardized one. In Apache installs, this frequently resides in /etc/ssl/private. The rights on these files are very important, and some programs will refuse to load these certificates if they are set wrong.

Public Keys(.pkcs12 .pfx .p12)

Originally defined by RSA in the Public-Key Cryptography Standards, the "12" variant was enhanced by Microsoft. This is a passworded container format that contains both public and private certificate pairs. Unlike .pem files, this container is fully encrypted. Openssl can turn this into a .pem file with both public and private keys: openssl pkcs12 -in file-to-convert.p12 -out converted-file.pem -nodes

A few other formats that show up from time to time:

DER(.der) 

A way to encode ASN.1 syntax in binary, a .pem file is just a Base64 encoded .der file. OpenSSL can convert these to .pem (openssl x509 -inform der -in to-convert.der -out converted.pem). Windows sees these as Certificate files. By default, Windows will export certificates as .DER formatted files with a different extension. Like...
.cert .cer .crt. A .pem (or rarely .der) formatted file with a different extension, one that is recognized by Windows Explorer as a certificate, which .pem is not.

P7B(.p7b) 

Defined in RFC 2315, this is a format used by windows for certificate interchange. Java understands these natively. Unlike .pem style certificates, this format has a defined way to include certification-path certificates.

CRL(.crl) 

A certificate revocation list. Certificate Authorities produce these as a way to de-authorize certificates before expiration. You can sometimes download them from CA websites.
In summary, there are four different ways to present certificates and their components:

PEM Governed by RFCs, it's used preferentially by open-source software. It can have a variety of extensions (.pem, .key, .cer, .cert, more)

PKCS7 

An open standard used by Java and supported by Windows. Does not contain private key material.

PKCS12 

A private standard that provides enhanced security versus the plain-text PEM format. This can contain private key material. It's used preferentially by Windows systems, and can be freely converted to PEM format through use of openssl.

DER 

The parent format of PEM. It's useful to think of it as a binary version of the base64-encoded PEM file. Not routinely used by much outside of Windows.

Openssl create SSL certificate

What is SSL?

SSL (Secure Sockets Layer) is a standard security technology for establishing an encrypted link between a server and a client—typically a web server (website) and a browser or a mail server and a mail client (e.g., Outlook, Thunderbird).

So to make our server support SSL, we need to create SSL certificate for our server.

SSL certificate can be either Self-signed or signed by some authority like OpenCA.

How to create a SSL certificate?

To create a certificate we have to use a tool called openssl available for all operating systems.

And, follow these steps:

1. Create a private key using following command:

openssl genrsa -des3 -out server.key 1024

This will ask for a secure password for our key:

Generating RSA private key, 1024 bit long modulus

.......++++++

..............++++++

unable to write 'random state'

e is 65537 (0x10001)

Enter pass phrase for server.key:

Verifying - Enter pass phrase for server.key:

A server.key file will be created in the directory.

2. Remove Passphrase from Key

openssl genrsa -out server.key 1024

This will not ask for pass phrase every time it will be used.

3. Create a signing request (Certificate Signing Request):

openssl req -new -key server.key -out server.csr

This as for server information

Enter pass phrase for server.key:

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:IN

State or Province Name (full name) [Some-State]:UP

Locality Name (eg, city) []:NOIDA

Organization Name (eg, company) [Internet Widgits Pty Ltd]:Open Source

Organizational Unit Name (eg, section) []:JAVA

Common Name (e.g. server FQDN or YOUR name) []:localhost

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:changeit

An optional company name []:localhost

A server.csr file will be created in the directory. This file can used to send to the signing authority or can be used to create a self signed certificate.

4. Create a Self signed certificate: 

Create a self signed certificate using private key:

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

This will create a server.crt file in the directory.

5. Add certificate to trusted certificates list in JAVA:

Create a DER format file of certificate:

openssl x509 -in server.crt -out server.der -outform DER

Adding certificate to trusted certificates using java keytool which is available in java bin directory:

keytool -import -keystore $JAVA_HOME/jre/lib/security/cacerts -file server.der -alias server

This will add our created certificate to JAVA trusted certificates list which is necessary for java based applications.

6. Configuring SSL Enabled Virtual Hosts

Now edit virtual host configuration to add following lines:

SSLEngine on

SSLCertificateFile /path/to/server.crt

SSLCertificateKeyFile path/to/server.key