0

I was playing with openssl just to see how reading of the public key from a certificate works;

Gave a "letsencrypt.pem" certificate I have, I gave these commands.

  1. See the entire certificate text: openssl x509 -in letsencrypt.pem -text

    Which, in particulare, gives the public key as:

Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:9c:d3:0c:f0:5a:e5:2e:47:b7:72:5d:37:83:b3: 68:63:30:ea:d7:35:26:19:25:e1:bd:be:35:f1:70: 92:2f:b7:b8:4b:41:05:ab:a9:9e:35:08:58:ec:b1: 2a:c4:68:87:0b:a3:e3:75:e4:e6:f3:a7:62:71:ba: 79:81:60:1f:d7:91:9a:9f:f3:d0:78:67:71:c8:69: 0e:95:91:cf:fe:e6:99:e9:60:3c:48:cc:7e:ca:4d: 77:12:24:9d:47:1b:5a:eb:b9:ec:1e:37:00:1c:9c: ac:7b:a7:05:ea:ce:4a:eb:bd:41:e5:36:98:b9:cb: fd:6d:3c:96:68:df:23:2a:42:90:0c:86:74:67:c8: 7f:a5:9a:b8:52:61:14:13:3f:65:e9:82:87:cb:db: fa:0e:56:f6:86:89:f3:85:3f:97:86:af:b0:dc:1a: ef:6b:0d:95:16:7d:c4:2b:a0:65:b2:99:04:36:75: 80:6b:ac:4a:f3:1b:90:49:78:2f:a2:96:4f:2a:20: 25:29:04:c6:74:c0:d0:31:cd:8f:31:38:95:16:ba: a8:33:b8:43:f1:b1:1f:c3:30:7f:a2:79:31:13:3d: 2d:36:f8:e3:fc:f2:33:6a:b9:39:31:c5:af:c4:8d: 0d:1d:64:16:33:aa:fa:84:29:b6:d4:0b:c0:d8:7d: c3:93 Exponent: 65537 (0x10001)

  1. See the public key in particular: openssl x509 -in letsencrypt.pem -pubkey -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7No YzDq1zUmGSXhvb418XCSL7e4S0EFq6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf 15Gan/PQeGdxyGkOlZHP/uaZ6WA8SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K 671B5TaYucv9bTyWaN8jKkKQDIZ0Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+X hq+w3Brvaw2VFn3EK6BlspkENnWAa6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiV FrqoM7hD8bEfwzB/onkxEz0tNvjj/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3D kwIDAQAB -----END PUBLIC KEY-----

  2. See the public key modulus in particular: openssl x509 -in letsencrypt.pem -modulus Modulus=9CD30CF05AE52E47B7725D3783B3686330EAD735261925E1BDBE35F170922FB7B84B4105ABA99E350858ECB12AC468870BA3E375E4E6F3A76271BA7981601FD7919A9FF3D0786771C8690E9591CFFEE699E9603C48CC7ECA4D7712249D471B5AEBB9EC1E37001C9CAC7BA705EACE4AEBBD41E53698B9CBFD6D3C9668DF232A42900C867467C87FA59AB8526114133F65E98287CBDBFA0E56F68689F3853F9786AFB0DC1AEF6B0D95167DC42BA065B299043675806BAC4AF31B9049782FA2964F2A20252904C674C0D031CD8F31389516BAA833B843F1B11FC3307FA27931133D2D36F8E3FCF2336AB93931C5AFC48D0D1D641633AAFA8429B6D40BC0D87DC393

While the 1st and the 3rd outputs seem coherent to each other (modulus values are equal), I can't figure out what is written inside the second output. From the openssl x509 manual I read it is encoded in PEM format, so knowing that PEM is no more that a DER certificate base64 encoded I just tried something like:

echo "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EFq6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWAa6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQAB" | base64 -d | openssl x509 -inform DER -text

To see if I could get a human readable version of the public key starting from the PEM format, base64 decoding it and giving it to openssl ad a DER file; but i get this error:

unable to load certificate 140147034792384:error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag:../crypto/asn1/tasn_dec.c:1129: 140147034792384:error:0D06C03A:asn1 encoding routines:asn1_d2i_ex_primitive:nested asn1 error:../crypto/asn1/tasn_dec.c:693: 140147034792384:error:0D08303A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:626:Field=serialNumber, Type=X509_CINF 140147034792384:error:0D08303A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:626:Field=cert_info, Type=X509

Moreover, creating a PEM file and giving it to openssl doesn't work either: openssl x509 -inform PEM -text -in test.pem (with the snippet of the second command output inside test.pem)

unable to load certificate 139920384565696:error:0906D06C:PEM routines:PEM_read_bio:no start line:../crypto/pem/pem_lib.c:691:Expecting: TRUSTED CERTIFICATE

Maybe it's expecting something like -----BEGIN CERTIFICATE----- instead of -----BEGIN PUBLIC KEY-----?

How can I read the public key (possibly in whatever format I want) starting from second command output snippet?

1

How can I read the public key (possibly in whatever format I want) starting from second command output snippet?

Use the openssl pkey command:

$ cat pubkey.pem
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7No
YzDq1zUmGSXhvb418XCSL7e4S0EFq6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf
15Gan/PQeGdxyGkOlZHP/uaZ6WA8SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K
671B5TaYucv9bTyWaN8jKkKQDIZ0Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+X
hq+w3Brvaw2VFn3EK6BlspkENnWAa6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiV
FrqoM7hD8bEfwzB/onkxEz0tNvjj/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3D
kwIDAQAB
-----END PUBLIC KEY-----
$ openssl pkey -pubin -in pubkey.pem -text_pub -noout
Public-Key: (2048 bit)
Modulus:
    00:9c:d3:0c:f0:5a:e5:2e:47:b7:72:5d:37:83:b3:
    68:63:30:ea:d7:35:26:19:25:e1:bd:be:35:f1:70:
    92:2f:b7:b8:4b:41:05:ab:a9:9e:35:08:58:ec:b1:
    2a:c4:68:87:0b:a3:e3:75:e4:e6:f3:a7:62:71:ba:
    79:81:60:1f:d7:91:9a:9f:f3:d0:78:67:71:c8:69:
    0e:95:91:cf:fe:e6:99:e9:60:3c:48:cc:7e:ca:4d:
    77:12:24:9d:47:1b:5a:eb:b9:ec:1e:37:00:1c:9c:
    ac:7b:a7:05:ea:ce:4a:eb:bd:41:e5:36:98:b9:cb:
    fd:6d:3c:96:68:df:23:2a:42:90:0c:86:74:67:c8:
    7f:a5:9a:b8:52:61:14:13:3f:65:e9:82:87:cb:db:
    fa:0e:56:f6:86:89:f3:85:3f:97:86:af:b0:dc:1a:
    ef:6b:0d:95:16:7d:c4:2b:a0:65:b2:99:04:36:75:
    80:6b:ac:4a:f3:1b:90:49:78:2f:a2:96:4f:2a:20:
    25:29:04:c6:74:c0:d0:31:cd:8f:31:38:95:16:ba:
    a8:33:b8:43:f1:b1:1f:c3:30:7f:a2:79:31:13:3d:
    2d:36:f8:e3:fc:f2:33:6a:b9:39:31:c5:af:c4:8d:
    0d:1d:64:16:33:aa:fa:84:29:b6:d4:0b:c0:d8:7d:
    c3:93
Exponent: 65537 (0x10001)
$

You can also use this tool to convert between the public key between PEM and DER format:

$ openssl pkey -pubin -inform PEM -outform DER -in pubkey.pem -out pubkey.der

Once you stripped the public key out of the certificate, openssl x509 was no longer the right tool, because a public key is not an x.509 certificate. Similarly, when you tried to extract the DER from the PEM by base64 decoding it, you succeeded in getting the DER right; however, you then attempted to use that DER as if it were a certificate DER and not a public key DER; that is what caused the errors.

This snippet shows how you got the right DER out by comparing it to the one created with openssl pkey just above:

$ egrep -v " KEY" pubkey.pem | base64 -d - > pubkey.der.by-b64
$ md5sum *.der*
360f52925de443e7603376664435df46  pubkey.der
360f52925de443e7603376664435df46  pubkey.der.by-b64
$

You may also wish to examine openssl pkeyutl, although both pkey and pkeyutil are oriented towards private keys, they do allow operations with bare public keys.

  • Thank you very much for the very good answer! I only got a little doubt on the "-" char in the following command you issued: "egrep -v " KEY" pubkey.pem | base64 -d - > pubkey.der.by-b64" I did some tests and for me something like "echo 'test' - > test.txt" resulted in a file with the string "test -" inside, while when I issued "echo 'test' > test.txt, I saw "test", as expected. So I created two files from the pubkey.pem file, with the command issued in the two formats. I expected the md5 sums to be different because of the extra dash, but they just resulted the same... What happened? – Alessio Martorana Sep 29 '18 at 22:09
  • @AlessioMartorana The "-" in the command base64 -d - tells base64 to read the file to be decoded from STDIN ("Standard Input") instead of from a file. So the "-" doesn't end up in the output, the way it does with the echo command. That's just a shorthand way of taking the output of egrep -v " KEY" pubkey.pem, which removes the BEGIN and END lines from pubkey.pem, and stuffing it into the input of base64. – gowenfawr Sep 29 '18 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.