0

I was playing with openssl just to see how reading of the public key from a certificate works;

Gave a "letsencrypt.pem" certificate I have, I gave these commands.

  1. See the entire certificate text: openssl x509 -in letsencrypt.pem -text

    Which, in particulare, gives the public key as:

Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:9c:d3:0c:f0:5a:e5:2e:47:b7:72:5d:37:83:b3: 68:63:30:ea:d7:35:26:19:25:e1:bd:be:35:f1:70: 92:2f:b7:b8:4b:41:05:ab:a9:9e:35:08:58:ec:b1: 2a:c4:68:87:0b:a3:e3:75:e4:e6:f3:a7:62:71:ba: 79:81:60:1f:d7:91:9a:9f:f3:d0:78:67:71:c8:69: 0e:95:91:cf:fe:e6:99:e9:60:3c:48:cc:7e:ca:4d: 77:12:24:9d:47:1b:5a:eb:b9:ec:1e:37:00:1c:9c: ac:7b:a7:05:ea:ce:4a:eb:bd:41:e5:36:98:b9:cb: fd:6d:3c:96:68:df:23:2a:42:90:0c:86:74:67:c8: 7f:a5:9a:b8:52:61:14:13:3f:65:e9:82:87:cb:db: fa:0e:56:f6:86:89:f3:85:3f:97:86:af:b0:dc:1a: ef:6b:0d:95:16:7d:c4:2b:a0:65:b2:99:04:36:75: 80:6b:ac:4a:f3:1b:90:49:78:2f:a2:96:4f:2a:20: 25:29:04:c6:74:c0:d0:31:cd:8f:31:38:95:16:ba: a8:33:b8:43:f1:b1:1f:c3:30:7f:a2:79:31:13:3d: 2d:36:f8:e3:fc:f2:33:6a:b9:39:31:c5:af:c4:8d: 0d:1d:64:16:33:aa:fa:84:29:b6:d4:0b:c0:d8:7d: c3:93 Exponent: 65537 (0x10001)

  1. See the public key in particular: openssl x509 -in letsencrypt.pem -pubkey -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7No YzDq1zUmGSXhvb418XCSL7e4S0EFq6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf 15Gan/PQeGdxyGkOlZHP/uaZ6WA8SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K 671B5TaYucv9bTyWaN8jKkKQDIZ0Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+X hq+w3Brvaw2VFn3EK6BlspkENnWAa6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiV FrqoM7hD8bEfwzB/onkxEz0tNvjj/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3D kwIDAQAB -----END PUBLIC KEY-----

  2. See the public key modulus in particular: openssl x509 -in letsencrypt.pem -modulus Modulus=9CD30CF05AE52E47B7725D3783B3686330EAD735261925E1BDBE35F170922FB7B84B4105ABA99E350858ECB12AC468870BA3E375E4E6F3A76271BA7981601FD7919A9FF3D0786771C8690E9591CFFEE699E9603C48CC7ECA4D7712249D471B5AEBB9EC1E37001C9CAC7BA705EACE4AEBBD41E53698B9CBFD6D3C9668DF232A42900C867467C87FA59AB8526114133F65E98287CBDBFA0E56F68689F3853F9786AFB0DC1AEF6B0D95167DC42BA065B299043675806BAC4AF31B9049782FA2964F2A20252904C674C0D031CD8F31389516BAA833B843F1B11FC3307FA27931133D2D36F8E3FCF2336AB93931C5AFC48D0D1D641633AAFA8429B6D40BC0D87DC393

While the 1st and the 3rd outputs seem coherent to each other (modulus values are equal), I can't figure out what is written inside the second output. From the openssl x509 manual I read it is encoded in PEM format, so knowing that PEM is no more that a DER certificate base64 encoded I just tried something like:

echo "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EFq6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWAa6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQAB" | base64 -d | openssl x509 -inform DER -text

To see if I could get a human readable version of the public key starting from the PEM format, base64 decoding it and giving it to openssl ad a DER file; but i get this error:

unable to load certificate 140147034792384:error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag:../crypto/asn1/tasn_dec.c:1129: 140147034792384:error:0D06C03A:asn1 encoding routines:asn1_d2i_ex_primitive:nested asn1 error:../crypto/asn1/tasn_dec.c:693: 140147034792384:error:0D08303A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:626:Field=serialNumber, Type=X509_CINF 140147034792384:error:0D08303A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:626:Field=cert_info, Type=X509

Moreover, creating a PEM file and giving it to openssl doesn't work either: openssl x509 -inform PEM -text -in test.pem (with the snippet of the second command output inside test.pem)

unable to load certificate 139920384565696:error:0906D06C:PEM routines:PEM_read_bio:no start line:../crypto/pem/pem_lib.c:691:Expecting: TRUSTED CERTIFICATE

Maybe it's expecting something like -----BEGIN CERTIFICATE----- instead of -----BEGIN PUBLIC KEY-----?

How can I read the public key (possibly in whatever format I want) starting from second command output snippet?

Improve this question

1 Answer 1

Reset to default
1

How can I read the public key (possibly in whatever format I want) starting from second command output snippet?

Use the openssl pkey command:

$ cat pubkey.pem
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7No
YzDq1zUmGSXhvb418XCSL7e4S0EFq6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf
15Gan/PQeGdxyGkOlZHP/uaZ6WA8SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K
671B5TaYucv9bTyWaN8jKkKQDIZ0Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+X
hq+w3Brvaw2VFn3EK6BlspkENnWAa6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiV
FrqoM7hD8bEfwzB/onkxEz0tNvjj/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3D
kwIDAQAB
-----END PUBLIC KEY-----
$ openssl pkey -pubin -in pubkey.pem -text_pub -noout
Public-Key: (2048 bit)
Modulus:
    00:9c:d3:0c:f0:5a:e5:2e:47:b7:72:5d:37:83:b3:
    68:63:30:ea:d7:35:26:19:25:e1:bd:be:35:f1:70:
    92:2f:b7:b8:4b:41:05:ab:a9:9e:35:08:58:ec:b1:
    2a:c4:68:87:0b:a3:e3:75:e4:e6:f3:a7:62:71:ba:
    79:81:60:1f:d7:91:9a:9f:f3:d0:78:67:71:c8:69:
    0e:95:91:cf:fe:e6:99:e9:60:3c:48:cc:7e:ca:4d:
    77:12:24:9d:47:1b:5a:eb:b9:ec:1e:37:00:1c:9c:
    ac:7b:a7:05:ea:ce:4a:eb:bd:41:e5:36:98:b9:cb:
    fd:6d:3c:96:68:df:23:2a:42:90:0c:86:74:67:c8:
    7f:a5:9a:b8:52:61:14:13:3f:65:e9:82:87:cb:db:
    fa:0e:56:f6:86:89:f3:85:3f:97:86:af:b0:dc:1a:
    ef:6b:0d:95:16:7d:c4:2b:a0:65:b2:99:04:36:75:
    80:6b:ac:4a:f3:1b:90:49:78:2f:a2:96:4f:2a:20:
    25:29:04:c6:74:c0:d0:31:cd:8f:31:38:95:16:ba:
    a8:33:b8:43:f1:b1:1f:c3:30:7f:a2:79:31:13:3d:
    2d:36:f8:e3:fc:f2:33:6a:b9:39:31:c5:af:c4:8d:
    0d:1d:64:16:33:aa:fa:84:29:b6:d4:0b:c0:d8:7d:
    c3:93
Exponent: 65537 (0x10001)
$

You can also use this tool to convert between the public key between PEM and DER format:

$ openssl pkey -pubin -inform PEM -outform DER -in pubkey.pem -out pubkey.der

Once you stripped the public key out of the certificate, openssl x509 was no longer the right tool, because a public key is not an x.509 certificate. Similarly, when you tried to extract the DER from the PEM by base64 decoding it, you succeeded in getting the DER right; however, you then attempted to use that DER as if it were a certificate DER and not a public key DER; that is what caused the errors.

This snippet shows how you got the right DER out by comparing it to the one created with openssl pkey just above:

$ egrep -v " KEY" pubkey.pem | base64 -d - > pubkey.der.by-b64
$ md5sum *.der*
360f52925de443e7603376664435df46  pubkey.der
360f52925de443e7603376664435df46  pubkey.der.by-b64
$

You may also wish to examine openssl pkeyutl, although both pkey and pkeyutil are oriented towards private keys, they do allow operations with bare public keys.

Improve this answer
2
  • Thank you very much for the very good answer! I only got a little doubt on the "-" char in the following command you issued: "egrep -v " KEY" pubkey.pem | base64 -d - > pubkey.der.by-b64" I did some tests and for me something like "echo 'test' - > test.txt" resulted in a file with the string "test -" inside, while when I issued "echo 'test' > test.txt, I saw "test", as expected. So I created two files from the pubkey.pem file, with the command issued in the two formats. I expected the md5 sums to be different because of the extra dash, but they just resulted the same... What happened?
    – ela
    Commented Sep 29, 2018 at 22:09
  • @AlessioMartorana The "-" in the command base64 -d - tells base64 to read the file to be decoded from STDIN ("Standard Input") instead of from a file. So the "-" doesn't end up in the output, the way it does with the echo command. That's just a shorthand way of taking the output of egrep -v " KEY" pubkey.pem, which removes the BEGIN and END lines from pubkey.pem, and stuffing it into the input of base64.
    – gowenfawr
    Commented Sep 29, 2018 at 22:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .