0

Created a root certificate(cacert.pem) and tried viewing the content to primarily understand the contents of certificate, mainly the signature appended to certificate.


Below is the text output of root certificate(created for learning):

$ openssl x509 -inform pem -in cacert.pem -noout -text | more
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10810749767368875050 (0x96077fa2b7a89c2a)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=CA, ST=Ontario, L=Scarborough, O=1795 Canada Inc., CN=abc-ubuntu.laptop.local/emailAddress=abc.def@gmail.com
        Validity
            Not Before: Jun  4 16:54:02 2019 GMT
            Not After : Jun  1 16:54:02 2029 GMT
        Subject: C=CA, ST=Ontario, L=Scarborough, O=1795 Canada Inc., CN=abc-ubuntu.laptop.local/emailAddress=abc.def@gmail.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:c3:4c:c0:41:83:cb:0e:6e:7d:cc:0f:bd:da:32:
                    28:3d:15:8a:5d:7f:28:85:fb:26:86:0f:3a:9a:b1:
                    5e:e7:f0:ad:7d:02:11:d4:13:fd:7d:7d:b8:83:b5:
                    58:2d:ad:f1:58:8d:df:49:d5:51:cc:67:01:03:b1:
                    63:88:1a:af:ce:0c:0c:2d:b6:3f:fb:39:d7:45:5f:
                    e4:5c:34:84:04:2a:3b:b1:57:4b:21:82:b3:d0:8f:
                    98:06:9f:4c:87:67:ec:48:7a:ba:c1:b0:eb:e7:da:
                    e9:c4:c7:42:4f:3c:c8:d0:20:8c:64:51:3e:ee:52:
                    00:ca:c6:8d:e9:4a:05:67:4e:d5:51:64:25:29:d0:
                    12:f6:b6:b7:96:fa:5e:d2:e1:5d:64:54:c3:2a:d6:
                    ef:2e:31:15:23:f7:a0:cf:1f:74:02:63:c4:b3:93:
                    5f:68:ee:a2:b6:47:09:31:19:8c:61:10:b8:46:27:
                    d3:88:10:c9:8f:3d:19:83:a7:dc:66:c7:f6:35:28:
                    8f:37:7d:49:3f:73:6a:f7:61:b6:5f:56:50:ea:1c:
                    2b:ab:2c:68:e6:1a:88:b7:90:df:49:f3:a7:e7:e3:
                    16:95:6f:80:9c:2b:1c:15:c4:82:7f:9c:73:45:b4:
                    24:45:f8:f8:bb:e2:d2:b5:f8:cc:76:97:b7:0a:c1:
                    39:94:25:3a:68:d3:e1:c3:c8:f4:4c:03:7f:a2:12:
                    87:ea:2e:c9:49:1d:38:1b:3f:fe:ac:04:f2:0d:81:
                    f6:45:11:e5:d8:cd:a1:cf:6d:bd:93:cb:26:12:35:
                    06:1c:10:e9:9f:10:ee:6d:b3:75:1b:40:bc:8c:d9:
                    70:af:25:27:c5:d9:a1:a1:55:72:1e:20:8f:e0:7a:
                    45:7f:97:51:ef:63:5d:37:76:0e:96:ed:bf:22:0e:
                    9c:8e:91:6d:f4:9a:01:e6:e6:9f:c3:44:27:30:5a:
                    95:3b:6a:86:84:ad:c7:5d:f1:b3:55:bc:a7:7a:0a:
                    d6:de:e5:1c:dc:a8:e6:11:10:f4:23:3b:25:19:19:
                    60:6a:72:a4:c2:01:35:3a:9a:49:4a:6d:aa:86:c4:
                    1d:e9:1d:a6:3d:05:03:2a:50:8c:f0:3b:0f:f8:50:
                    96:e0:6a:04:db:63:37:54:6e:4d:18:43:dc:c6:32:
                    95:c4:18:7f:7f:ab:21:f8:de:c9:db:79:ef:7b:27:
                    f8:43:d4:0e:d0:9c:b3:4b:b5:aa:55:c2:b4:7b:ab:
                    60:15:e9:2a:f7:24:19:60:80:7b:bc:5e:76:79:c1:
                    84:2d:1a:60:78:84:54:8b:a2:a1:8a:00:ef:bd:7b:
                    61:84:7a:3b:ce:7d:46:02:aa:47:21:b0:ff:8c:72:
                    d2:06:97
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                B7:D7:72:C3:EF:06:5B:07:12:F5:2D:CD:CD:A4:B4:B3:FF:F0:AF:34
            X509v3 Authority Key Identifier: 
                keyid:B7:D7:72:C3:EF:06:5B:07:12:F5:2D:CD:CD:A4:B4:B3:FF:F0:AF:34

            X509v3 Basic Constraints: 
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
         46:ba:db:bc:e2:96:de:d2:96:61:66:7f:54:b9:35:59:90:db:
         91:10:8b:eb:df:b1:31:95:5d:0e:9a:dc:22:6c:99:c5:3a:0c:
         c2:f4:17:34:c6:12:da:3d:b4:f5:42:ee:f4:de:08:2e:5b:5e:
         e3:35:b9:d8:f7:d6:a4:ab:2a:d0:99:e7:2c:54:7a:70:15:02:
         87:6c:1a:09:87:7c:ce:2e:36:65:76:d6:44:33:b7:88:3d:23:
         91:d7:7e:27:6f:04:6b:84:0e:3e:24:ad:dc:2e:a8:7a:13:5c:
         53:ce:4c:43:2b:cc:d5:8b:17:50:a1:0b:31:68:31:51:d3:c0:
         be:98:3a:54:b7:79:31:dc:03:48:37:c6:c7:43:11:87:00:46:
         d0:d6:3a:27:1b:2b:fc:4f:6a:fa:07:b0:aa:5d:27:27:78:99:
         e6:25:da:f6:e1:f7:25:85:06:14:60:d2:b0:91:91:b7:37:61:
         90:fa:d2:86:e2:0b:ed:7c:fd:1c:53:ce:58:76:2b:65:ed:85:
         62:8d:f0:73:1d:d6:ec:f4:93:98:50:a9:0f:e9:b3:9e:2d:38:
         35:63:76:53:e5:35:77:4a:06:1e:35:bc:41:49:31:d0:0d:16:
         5a:44:8c:f7:a8:ee:a3:76:a5:90:41:be:cd:ec:90:58:bc:e7:
         4f:52:9b:5d:6f:e1:0c:fd:d8:42:19:2e:dc:dc:37:dc:6c:9e:
         bf:69:e7:6b:5b:e3:bd:9f:70:04:9f:35:76:6d:ab:a5:e9:14:
         61:6b:43:f0:4d:48:e8:be:fa:bc:cd:db:1a:cd:23:68:1b:88:
         07:e1:11:85:2d:b1:09:22:0b:17:2c:e3:21:cc:89:92:92:27:
         18:e9:fc:19:a5:2d:03:8b:56:48:09:ca:0b:9e:a1:48:4f:7d:
         2c:13:71:f6:9d:f9:24:aa:94:54:7f:47:3f:be:6c:f4:f1:12:
         38:65:37:78:d8:b6:88:25:aa:d4:35:1a:cc:12:47:fe:b0:38:
         ec:39:d7:66:b0:99:80:a5:5f:ce:f2:98:b8:b4:38:6f:f4:fe:
         81:be:5d:40:fb:fb:3d:98:f4:66:db:5e:bf:db:f5:f0:cd:65:
         d5:e0:6c:3b:38:40:db:3a:43:1e:d6:16:95:60:77:cb:36:40:
         bc:64:7a:69:89:22:44:b0:ed:97:3c:c4:5a:9e:51:66:15:0f:
         9e:cc:c0:48:36:87:eb:15:c5:7b:b6:e6:5a:a8:0b:f9:d8:f9:
         f0:20:01:02:97:f7:e1:4c:4a:c8:44:0e:57:d7:5c:e0:88:63:
         68:1d:d4:9f:0e:3f:d2:b7:8b:7c:29:64:14:d2:54:e7:02:05:
         89:61:25:69:d4:68:e0:4a

Are the hex digits(starting as 46:ba:db:...) a digital signature of this root certificate(self-signed)? appended in the end of root certificate...

1

Are the hex digits(starting as 46:ba:db:...) a digital signature of this root certificate(self-signed)? appended in the end of root certificate...

You are mostly correct in that the signature is attached to the certificate. However, the “hex digits” aren’t simply stuck at the end of the file. Certificates are written in very specific standardized formats. Your certificate, for example, is an X.509 certificate, which is encoded using a scheme called ASN.1, and this scheme specifies exactly how the bits of the signature are tagged and structured as a part of the document.

Making matters even more complicated is that ASN.1 is a binary format (in certificates, you may hear people call this DER format, CRT format, or raw format). Binary is great for computers, but people needed to convert certificates to a character format for use on the web, in emails, etc. Your certificate is in an ASCII-armored format, a tagged Base64 encoded version of the raw ASN.1 format. This is also often called PEM format.

So it’s almost as simple as you were thinking, but it’s a lot more complicated than that.

  • PEM format (or encoding or 'armor') is indeed base64+linebreaks+labels, and applies to many kinds of binary/ASN.1 data including in this case an X.509 cert, but is different from and orthogonal to PKCS7 (and its successor CMS) which is a format for a whole range of crypto-related messages, such as signed data (or detached signature) and enveloped data. OpenSSL commandline also supports PKCS7/CMS, in both binary/DER and PEM, and additionally the closely related S/MIME, but with different commands. – dave_thompson_085 Jun 6 at 2:13
  • Thanks @dave_thompson_085 , I edited the answer to eliminate the wrong info. – John Deters Jun 6 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.