More clarity on Certificate, public key, hash

Question

I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below.

I've used below command to see what this certificate contains.

openssl x509 -inform pem -text -in test1.pem

then I see some data like issuer, company etc. Also I see public key info. which looks like below.

Now what is my public key here. Modulus is something product of the 2 chosen large prime numbers. In the below it is separated with xx: xx: xx: .. etc. is it a continuous large number in hex format? exponent should be the E with which we encrypt.

Finally, How to see only encoded public key from a certificate? How do we take sha1 hash to hash the public key?

Answer 1

What you are looking at (PEM, text) are just two possible views of the same data.

what is my public key here ... is it a continuous large number in hex format

A key is a sequence of bytes. Hex format is just a representation of these bytes as text in order to be viewable by a human. There are different kinds of public keys (RSA, ECC,...) and what the sequence of bytes exactly mean depends on the kind of. What you see here are not the pure bytes of the RSA key itself but already an interpretation of the bytes, i.e. the modulus and exponent of the RSA public key.

How to see only encoded public key from a certificate

The public key can be extracted from the certificate with

$ openssl x509 -in cert.pem -pubkey -noout

If you only want to get to the bytes of the key itself and strip the encapsulation you can use openssl asn1parse -in pubkey.pem -dump to get to the details. See also RSA: Get exponent and modulus given a public key on how to extract exponent and modulus from the public key.

How do we take sha1 hash to hash the public key?

Once you have the public key as PEM (as above) you can convert it to binary and take the sha1 of it. Conversation to binary is done by stripping the PEM header and footer (grep -v '^-') and then converting the rest from base64 to binary (base64 -d):

$ openssl x509 -in cert.pem -pubkey -noout | grep -v '^-' | base64 -d | openssl sha1