2

I know to create a root certificate with openssl, I should first create a root private key:

openssl genrsa -out rootCA.key 2048

Then, self sign the certificate:

openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.p12

I am wondering, how can I generate a root certificate in .p12 format without a private key?

Improve this question
1
  • 2
    That's not .p12 format. Just .PEM format with the (wrong) .p12 file name extension. Do you really, really need p12 format? (If what you did works, then you don't, since it never was P12.)
    – StackzOfZtuff
    Jan 2, 2017 at 8:13

2 Answers 2

Reset to default
3 
openssl pkcs12 -export -nokeys -in certificate.cer -out pkcs12.pfx
Improve this answer
0
2

This is the one-line version:

openssl req -x509 -nodes -days 999 -subj '/CN=myRSAdemoserver' -newkey rsa:2048 -keyout server.pem -out server.pem

Both privkey and pubkey end up in the server.pem file. This is sometimes called a "PEM bundle". (Also: it is specifically NOT P12 format. See my comment under the original question.)

And it's CA enabled: (not because of the options I used, but just because that is the default on vanilla OpenSSL. Thanks @dave_thompson_085.)

$ openssl x509 -in server.pem -noout -text | grep -B1 '  CA:'
            X509v3 Basic Constraints:
                CA:TRUE
Improve this answer
2
  • req -newkey is slightly simpler to use, but if you're suggesting it changes BC that's wrong. (-new IOR -newkey) AND -x509 uses the config setting req.x509_extensions which normally (at least in upstream) points to v3_ca which has BC.CA=true. Also, this doesn't answer the question asked!
    – dave_thompson_085
    Jan 1, 2017 at 5:49
  • @dave_thompson_085. Thanks. Yeah, wasn't being really clear.(1) none of these options change baseline requirements. I just wasn't sure if the "CA:" field would be included at all. Clarified that. (2) Yes. It doesn't make anything P12 format. But neither was it in the original question. I asked OP to clarify.
    – StackzOfZtuff
    Jan 2, 2017 at 8:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .