OpenSSL: Generating an RSA Key From the Command Line
2014-11-04 14:00
288 查看
原文:https://rietta.com/blog/2012/01/27/openssl-generating-rsa-key-from-command/
OpenSSL: Generating an RSA Key From the Command Line
JAN 27TH, 2012 ♦ POSTEDBY FRANK RIETTA
Last Updated on March 18, 2014. Thanks to a tip from Chase Schultz, a security researcher in
San Francisco, it came to my attention that the instructions in this post contained an error and if you followed them exactly you ended up exporting copy of the private key rather than the public key.
I have updated this post to correct the error related to the command used to export the public key. The
-puboutflag
had been editorially dropped in error when this blog was converted to Markdown format from
the old Blogger site. The example has been corrected and additional information about how to visually inspect the generated key file to ensure that it is a public key and not a private key has been added.
If you discover an error in the content on this post or any post on this blog, please contact me privately and it will be addressed ASAP. If the discovery is security related, please follow Rietta’s
Responsible Disclosure contact procedure.
This post is one of the most visited on this blog and is a maintained post that is periodically updated to be most useful to you. For more, see the list
of all maintained posts.
This post is part of our ongoing Encryption Series that
provides in-depth coverage of OpenSSL. To learn more about encryption key generation, management, and use please see the posts in the Encryption category. Our tips
and tricks are immediately applicable with examples that you can use right away. If you like this article, you may be interested in the Raspberry Pi crypto key
management project.
A few of weeks ago, I posted about how to Encrypt a File with a Password from the Command Line using OpenSSL. While very useful in its own right,
the real power of the OpenSSL library is its ability to support the use of public key cryptograph
for encrypting or validating data in an unattended manner (where the password is not required to encrypt) is done with public keys.
The Commands to Run
Generate a 2048 bit RSA Key
You can generate a public and private RSA key pair like this:openssl genrsa -des3 -out private.pem 2048
That generates a 2048-bit RSA key pair, encrypts them with a password you provide, and writes them to a file. You need to next extract the public key file. You will use this, for instance, on your web server to encrypt content so that it can only be read with
the private key.
Export the RSA Public Key to a File
This is a command that isopenssl rsa -in private.pem -outform PEM -pubout -out public.pem
The
-puboutflag
is really important. Be sure to include it.
Next open the
public.pemand
ensure that it starts with a
-----BEGIN PUBLIC KEY-----. This is how you know that this file is the public key of the pair and not a private key.
To check the file from the command line you can use the
lesscommand,
like this:
less public.pem
Do Not Run This, it Exports the Private Key
A previous version of the post gave this example in error.openssl rsa -in private.pem -out private_unencrypted.pem -outform PEM
The error is that the
-puboutwas
dropped from the end of the command. That changes the meaning of the command from that of exporting the public key to exporting the private key outside of its encrypted wrapper. Inspecting the output file, in this case
private_unencrypted.pemclearly
shows that the key is a RSA private key as it starts with
-----BEGIN RSA PRIVATE KEY-----.
Visually Inspect Your Key Files
It is important to visually inspect you private and public key files to make sure that they are what you expect. OpenSSL will clearly explain the nature of the key block with a -----BEGIN RSA PRIVATE KEY-----or
-----BEGIN PUBLIC KEY-----.
You can use less to inspect each of your two files in turn:
less private.pemto verify that it starts with a
-----BEGIN RSA PRIVATE KEY-----
less public.pemto verify that it starts with a
-----BEGIN PUBLIC KEY-----
The next section shows a full example of what each key file should look like.
The Generated Key Files
The generated files are base64-encoded encryption keys in plain text format. If you select a password for your private key, its file will be encrypted with your password. Be sure to remember this password or the key pair becomes useless.
The private.pem file looks something like this:
private.pem1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 | -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,32495A90F3FF199D lrMAsSjjkKiRxGdgR8p5kZJj0AFgdWYa3OT2snIXnN5+/p7j13PSkseUcrAFyokc V9pgeDfitAhb9lpdjxjjuxRcuQjBfmNVLPF9MFyNOvhrprGNukUh/12oSKO9dFEt s39F/2h6Ld5IQrGt3gZaBB1aGO+tw3ill1VBy2zGPIDeuSz6DS3GG/oQ2gLSSMP4 OVfQ32Oajo496iHRkdIh/7Hho7BNzMYr1GxrYTcE9/Znr6xgeSdNT37CCeCH8cmP aEAUgSMTeIMVSpILwkKeNvBURic1EWaqXRgPRIWK0vNyOCs/+jNoFISnV4pu1ROF 92vayHDNSVw9wHcdSQ75XSE4Msawqv5U1iI7e2lD64uo1qhmJdrPcXDJQCiDbh+F hQhF+wAoLRvMNwwhg+LttL8vXqMDQl3olsWSvWPs6b/MZpB0qwd1bklzA6P+PeAU sfOvTqi9edIOfKqvXqTXEhBP8qC7ZtOKLGnryZb7W04SSVrNtuJUFRcLiqu+w/F/ MSxGSGalYpzIZ1B5HLQqISgWMXdbt39uMeeooeZjkuI3VIllFjtybecjPR9ZYQPt FFEP1XqNXjLFmGh84TXtvGLWretWM1OZmN8UKKUeATqrr7zuh5AYGAIbXd8BvweL Pigl9ei0hTculPqohvkoc5x1srPBvzHrirGlxOYjW3fc4kDgZpy+6ik5k5g7JWQD lbXCRz3HGazgUPeiwUr06a52vhgT7QuNIUZqdHb4IfCYs2pQTLHzQjAqvVk1mm2D kh4myIcTtf69BFcu/Wuptm3NaKd1nwk1squR6psvcTXOWII81pstnxNYkrokx4r2 7YVllNruOD+cMDNZbIG2CwT6V9ukIS8tl9EJp8eyb0a1uAEc22BNOjYHPF50beWF ukf3uc0SA+G3zhmXCM5sMf5OxVjKr5jgcir7kySY5KbmG71omYhczgr4H0qgxYo9 Zyj2wMKrTHLfFOpd4OOEun9Gi3srqlKZep7Hj7gNyUwZu1qiBvElmBVmp0HJxT0N mktuaVbaFgBsTS0/us1EqWvCA4REh1Ut/NoA9oG3JFt0lGDstTw1j+orDmIHOmSu 7FKYzr0uCz14AkLMSOixdPD1F0YyED1NMVnRVXw77HiAFGmb0CDi2KEg70pEKpn3 ksa8oe0MQi6oEwlMsAxVTXOB1wblTBuSBeaECzTzWE+/DHF+QQfQi8kAjjSdmmMJ yN+shdBWHYRGYnxRkTatONhcDBIY7sZV7wolYHz/rf7dpYUZf37vdQnYV8FpO1um Ya0GslyRJ5GqMBfDS1cQKne+FvVHxEE2YqEGBcOYhx/JI2soE8aA8W4XffN+DoEy ZkinJ/+BOwJ/zUI9GZtwB4JXqbNEE+j7r7/fJO9KxfPp4MPK4YWu0H0EUWONpVwe TWtbRhQUCOe4PVSC/Vv1pstvMD/D+E/0L4GQNHxr+xyFxuvILty5lvFTxoAVYpqD u8gNhk3NWefTrlSkhY4N+tPP6o7E4t3y40nOA/d9qaqiid+lYcIDB0cJTpZvgeeQ ijohxY3PHruU4vVZa37ITQnco9az6lsy18vbU0bOyK2fEZ2R9XVO8fH11jiV8oGH -----END RSA PRIVATE KEY----- |
The public key, public.pem, file looks like:
public.pem1 2 3 4 5 6 7 8 9 | -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxzYuc22QSst/dS7geYYK 5l5kLxU0tayNdixkEQ17ix+CUcUbKIsnyftZxaCYT46rQtXgCaYRdJcbB3hmyrOa vkhTpX79xJZnQmfuamMbZBqitvscxW9zRR9tBUL6vdi/0rpoUwPMEh8+Bw7CgYR0 FK0DhWYBNDfe9HKcyZEv3max8Cdq18htxjEsdYO0iwzhtKRXomBWTdhD5ykd/fAC VTr4+KEY+IeLvubHVmLUhbE5NgWXxrRpGasDqzKhCTmsa2Ysf712rl57SlH0Wz/M r3F7aM9YpErzeYLrl0GhQr9BVJxOvXcVd4kmY+XkiCcrkyS1cnghnllh+LCwQu1s YwIDAQAB -----END PUBLIC KEY----- |
Protecting Your Keys
Depending on the nature of the information you will protect, it’s important to keep the private key backed up and secret. The public key can be distributed anywhere or embedded in your web application scripts, such as in your PHP, Ruby, or other scripts. Again,backup your keys!
Remember, if the key goes away the data encrypted to it is gone.Keeping a printed copy of the key material in a sealed envelope in a bank safety deposit box is a good way to protect important keys against loss due to fire or hard drive failure.
But! How do I use this Key?
Don’t worry, I will write about how to use your freshly minted RSA keys in a future blog post. In the mean time checkout the PHP functionality at http://us2.php.net/openssl_seal. Hint,you can use your new public key with openssl_seal.
I hope this helps!
Oh, and one last thing.
If you, dear reader, were planning any funny business with the private key that I have just published here. Know that they were made especially for this series of blog posts. I do not use them for anything else.
Invitation to the Web Application Topics Newsletter
This post is part of the Web Application Topics series. If you are interested in having futureissues sent directly to you by e-mail, please sign up for free, today. For back issues, see the Web
Application Topics category on this blog.
Revision History
As a maintained post, this document is updated from time to time.March 18, 2014: Corrected error related to the command used to export the public RSA key. The
-puboutflag
had been editorially dropped in error when this blog was converted to Markdown format from Blogger. The example has been corrected and additional content about checking the type of the key added.
January 3, 2014: Added the video version to visually demonstrate the process of generating a military-grade RSA key pair in Mac OS X Mavericks.
October 6, 2013: Promoted to a Maintained
Post status
September 3, 2013: Reformatted as part of the migration to the new blog.
January 27, 2012: Originally posted on The Rietta Blog, hosted on the Blogger platform
Posted by Frank
Rietta Jan 27th, 2012 Encryption, Maintained, Security, Web
Application Topics
相关文章推荐
- push an existing repository from the command line
- Run an Oracle Xellerate Task Scheduler from the Command-Line
- ios 命令行编译 Build an iPhone app from the command line
- Create a new repository on the command line/Push an existing repository from the command line
- [Node] Run Local DevDependencies from the Command Line with npx
- How to use FTP from the command line.
- stopManagedWebLogic.sh - Stopping a managed server from the command line
- Adding an existing project to GitHub using the command line
- chapter2. Managing files from the command line
- How can I get my public IP address from the command line, if I am behind a router?
- chapter2. Managing files from the command line
- [quote] How to determine what target is given in Makefile from the make command-line?
- Linux_SSH Warning: the RSA host key for differs from the key for the IP address
- 使用命令行工具管理Android项目(Managing Projects from the Command Line)
- Running DataVision from the Command Line
- Take screenshots from the command line in Linux
- SSH Warning: the RSA host key for differs from the key for the IP address
- Export Xellerate configuration objects to XML files from the command-line
- How to access Dropbox from the command line in Linux
- Launch Sublime Text 3 from the command line