1

When creating a signed certificate I get the lines inside the certificate that identify the keys used:

  X509v3 extensions:
     X509v3 Subject Key Identifier: 
         D8:D7:3F:99:CC:D7:20:AF:62:31:E2:EA:2C:8C:28:8C:B8:2F:0B:96
     X509v3 Authority Key Identifier: 
         keyid:D8:D7:3F:99:CC:D7:20:AF:62:31:E2:EA:2C:8C:28:8C:B8:2F:0B:96

Question: Given the CA key and the server key, is there a openssl command sequence with which I can generate the Subject Key Identifier and the Authority Key Identifier by hand?

  • Are you asking whether you can programatically derive the same Key Identifier values given the appropriate public keys? Or are you asking if you can use openssl to arbitrarily alter the Subject and Authority Key Identifier fields of a certificate? – gowenfawr Jul 1 '16 at 17:20
  • I would like to programatically (through openssl command calls) recreate the SKI and AKI from a key. Actually I found the answer for SKI here now: certificateerror.blogspot.se/2011/02/…. Does anyone know how it is done for AKI? The certificate is selfsigned, so the above two Identifiers should reference the same key, but they are different... – Konrad Eisele Jul 1 '16 at 18:10
  • ehem,,,they the same. solved. – Konrad Eisele Jul 1 '16 at 20:13
4

From http://certificateerror.blogspot.se/2011/02/how-to-validate-subject-key-identifier.html.

Extract SKI from cert:

#!/bin/bash                                                                                                                                                             
openssl x509  -noout -in $1 -pubkey  | openssl asn1parse  -strparse 19 -out tmp.pub.der
openssl dgst -c -sha1 tmp.pub.der

Exctract SKI from key:

#!/bin/bash                                                                                                                                                             
openssl rsa -in $1  -pubout | openssl asn1parse -strparse 19 -out tmp.pub.der
openssl dgst -c -sha1 tmp.pub.der
  • Could you click "Accept" if this worked for you? (That way it will no longer be listed in the "Unanswered" section.) – StackzOfZtuff Dec 29 '16 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.