When I run:
openssl genrsa -aes-256-gcm -out rootca.key 4096
Then I get the following output:
$ openssl genrsa -aes-256-gcm -out rootca.key 4096
Generating RSA private key, 8192 bit long modulus (2 primes)
..........................................................+++
..........................................................................+++
e is 65537 (0x010001)
Enter pass phrase for rootca.key:
Verifying - Enter pass phrase for rootca.key:
And when I run:
openssl req -sha512 -new -x509 -days 1000 -key rootca.key -out rootca.crt
I get the following error:
$ openssl req -sha512 -new -x509 -days 1000 -key rootca.key -out rootca.crt
Enter pass phrase for rootca.key:
unable to load Private Key
140287193601344:error:0906A065:PEM routines:PEM_do_header:bad decrypt:../crypto/pem/pem_lib.c:461:
For the above, I used OpenSSL 1.1.1f (provided by apt
.
I even tried using the latest 3.0.0-alpha version of OpenSSL. But I get a different error when generating the private key first of all:
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
4067E7A7827F0000:error:0300007A:digital envelope routines:evp_cipher_param_to_asn1_ex:cipher parameter error:crypto/evp/evp_lib.c:160:
4067E7A7827F0000:error:06800072:asn1 encoding routines:PKCS5_pbe2_set_iv:error setting cipher params:crypto/asn1/p5_pbev2.c:81:
4067E7A7827F0000:error:1188000D:PKCS12 routines:PKCS8_encrypt:ASN1 lib:crypto/pkcs12/p12_p8e.c:32:
How can I make this work?? Is AES-256-GCM not supported by OpenSSL? If so, is there an alternative to OpenSSL that can generate this type of key?
Btw, AES-256-CBC works perfectly. But, no luck with GCM.
-aes-256
, what openssl does is generate an RSA private key and encrypt this file with AES. If you then wish to create an x.509 certificate for the public key this private key belongs to, and use that certificate in a web server, then you will need to decrypt this private key on every start of the web server. That means the decrypted key will hang around in RAM anyways - giving you very little benefit over leaving the key decrypted.