[{"_1":2,"_188":-5,"_189":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_166":167},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_89":90,"_112":113,"_157":-5,"_158":11,"_159":21,"_160":11,"_161":-5,"_162":11,"_163":-5,"_164":165},"canonicalUrl","https://hub.docker.com/r/gunet/cert-req/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","gunet","reponame","cert-req","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":73,"_74":75,"_80":11,"_81":82,"_86":33,"_87":88},"categories",[],"content_types",[44],"image","date_registered","2023-02-17T09:25:46.279437Z","description","A simple Docker image to create certificate requests for web servers","is_private","last_updated","2024-08-26T11:10:40.057531Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.oci.image.index.v1+json","name","pull_count",1249,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# cert-req\nA simple Docker image to create certificate requests for web servers\n\n## Certificate operations via docker run\n* (Optional) Build: `docker build -t gunet/cert-req:latest .`\n* (Typical) Run: `docker run --rm -e ORG= -e SERVER= -v $PWD/certs:/var/cert-req/certs gunet/cert-req `\n* Example: `docker run --rm -e ORG=sch.gr -e SERVER=sso-01-test.sch.gr -v $PWD/certs:/var/cert-req/certs gunet/cert-req create`\n* If we want to pass the passphrase in stdin then we **need** to add the `-it` option.\n* Files (certificates, private keys, CSRs etc) will be in folder `$PWD/certs`\n* Possible arguments\n - `create`: Create a new private key and server.csr\n - `print`: Print CSR\n - `renew`: Regenerate the CSR reusing the same key\n - `encrypt`: Encrypt the private key with a pass phrase\n - `decrypt`: Remove the passphrase from an encrypted key\n - `encrypt-file`: Encrypt the file provided in the `FILE` environment variable with the `PASSPHRASE` (or we will request it) with symmetrical encryption. The resulting file will get a `.aes` extension\n - `decrypt-file`: Decrypt the file with symmetrical encryption. For the output file we remove the `.aes` extension. If it does not exist, we fail.\n - `self-sign`: Create a new private key and CSR and self-sign the certificate.\n - `self-sign-ca`: Create a CA, a private key and CSR and self-sign a certificate. The `certs/` folder will include the CSR and private key.\n - `resign-ca`: Re-sign the server certificate using the existing CA.\n - `dh`: Create a `dh.pem` DH parameters file\n* Passphrase:\n - Generally, the passphrase will be requested.\n - If an environment variable called `PASSPHRASE` is present then that will be used\n - If the environment variable is present and the command is `self-sign` or `self-sign-ca` then we will use it to encrypt the private key as well.\n* Filenames:\n - Certificate: `server.crt`\n - CSR: `server.csr`\n - Private key (no passphrase): `privkey.pem`\n - Private key (encrypted with passphrase): `privkey.key`\n\n## docker-compose\n* Build: `docker-compose build`\n* Run: `docker-compose run -e ORG= -e SERVER= --rm cert-req `\n* CSR and private key will be in $PWD/certs\n\n\n## Environment Variables\n* `ORG`: Organization (ie `GUNET`)\n* `SERVER`: The server DNS name\n* `PASSPHRASE`: The passphrase to use when encryting/decrypting. If it is not passed as an environment variable, it will be requested (you need to pass `-it` option in this case)\n* `SUBJALTNAMES`: A comma separated list of subAltNames to be included in the certificate request/self-signed certificate.\n* `FILE`: The (absolute) path (in the container context) for a file to be encrypted or decrypted\n\n## Image size\n* gunet/cert-req: 82.5MB\n - debian:bullseye-slm: 80.5MB\n\n## Process\n* Create certificate request with new key: `openssl req -new -newkey rsa:4096 -nodes -keyout privkey.pem -out server.csr -config server.cnf -batch`\n* Create a self-signed certificate with new key: `openssl req -x509 -newkey rsa:4096 -nodes -keyout privkey.pem -out server.csr -config server.cnd -sha256 -days 7300 -batch`\n* Self-sign a certificate using an already existing CSR and private key: `openssl req -x509 -in server.csr -config server.cnf -key privkey.pem -out server.crt -days 7300 -sha256 -batch`\n* Renew certificate request reusing key: `openssl req -new -key certs/privkey.pem -out certs/server.csr -config server.cnf -batch`\n* Print CSR: `openssl req -text -noout -verify -in certs/server.csr`\n\n## Private Keys\n* Check if a private key is encrypted or not: `openssl rsa -text -noout -in .key`\n* Encrypt a private key or change the passphrase: `openssl rsa -aes256 -passout PASS -in -out `\n - Note: Some algorithms like `des` are **not** supported by default by OpenSSL `v3.0` and should **not** be used\n* Remove the passphrase: `openssl rsa -in -out `\n* Remove the passphrase (passing the passphrase): `openssl rsa -passin PASS -in -out `\n* It is usually recommended to have the unencrypted private key end in `.pem` and the encrypted in `.key`\n* Symmetrical encryption on a file (passphrase in env variable):\n - Encrypt: `openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 -salt -pass PASS -in -out `\n - Decrypt: `openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 -salt -d -pass PASS -in -out `\n* `PASS` can be one of:\n - `pass:${PASS}`: A text passphrase\n - `env:PASS`: The passphrase will take the value of the environment variable `PASS`\n\n## DH Params\n* Create a DH params file (4096 bits length): `openssl dhparam -out certs/dh.pem 4096`\n\n## Print Certificate\n* Print certificate: `openssl x509 -text -in server.crt`\n* Print a certificate which is stored in DER format (usually certificates taken from an `Authority Information Access` endpoint): `openssl x509 -text -inform der -in `\n* Print certificate chain: `openssl crl2pkcs7 -nocrl -certfile server.crt | openssl pkcs7 -print_certs -noout`\n* Print md5 checksums:\n - For certificate: `openssl x509 -noout -modulus -in server.crt| openssl md5`\n - For key: `openssl rsa -noout -modulus -in privkey.pem| openssl md5`\n - For CSR: `openssl req -noout -modulus -in server.csr| openssl md5`\n* Expiration:\n - Show expiration: `openssl x509 -noout -enddate -in server.crt`\n - Show all dates: `openssl x509 -noout -dates -in server.crt`\n - Check expiration: `openssl x509 -noout -checkend -in server.crt`\n\n## crt.sh\n* [crt.sh](https://crt.sh/) is a tool to check/download Sectigo certificates online\n* Return a JSON strcture with non-expired leaf certificates for a specific domain: `https://crt.sh/?Identity=&exclude=expired&deduplicate=Y&output=json`\n\n## OpenSSL connect\n* We can use `openssl s_client` to directly connect to a server and check the TLS protocol\n* The usual run is: `openssl s_client -connect :443`\n* To quit just after TLS connection establishment: `time echo \"Q\" | openssl s_client -connect :443 2>1 >/dev/null`\n* If we add the `-servername` argument then openssl also does SNI\n### Test HTTPS web\n* Use the `-quiet` and the `-crlf` options\n* Example:\n```\n# openssl s_client -connect sso.asfa.gr:443 -quiet -crlf\nGET /login HTTP/1.1\nHost: sso.asfa.gr\n\n```\n### Testing SMTP (StartTLS)\n* [Reference](https://halon.io/blog/how-to-test-smtp-servers-using-the-command-line)\n* Connect to an SMTP server with StartTLS: `openssl s_client -quiet -connect relay.grnet.gr:587 -starttls smtp`\n* The `-quiet` flag is important in order to be able to issue capitalized SMTP commands with no problem.\n* Total test:\n```\n# openssl s_client -quiet -connect relay.grnet.gr:587 -starttls smtp\ndepth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority\nverify return:1\ndepth=1 C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4\nverify return:1\ndepth=0 C = GR, ST = Attik\\C3\\AD, O = National Infrastructures for Research and Technology, CN = relay.grnet.gr\nverify return:1\n250 HELP\nMAIL FROM: \n250 OK\nRCPT TO: \n250 Accepted\nDATA\n354 Enter message, ending with \".\" on a line by itself\nSubject: Test\ntest\n.\n250 OK id=1q6SbR-0007fb-Tr\nQUIT\n221 relay.grnet.gr closing connection\n```\n* Test SMTP auth:\n```\n# echo -n \"username\" | base64\ndXNlcm5hbWU=\n# echo -n \"password\" | base64\ncGFzc3dvcmQ=\n\n(cut)\n250 8BITMIME\nAUTH LOGIN\n334 VXNlcm5hbWU6\ndXNlcm5hbWU=\n334 UGFzc3dvcmQ6\ncGFzc3dvcmQ=\n235 2.7.0 Authentication successful\n```\n### Test SSL\n* The `testssl.sh` can run a set of SSL/TLS tests against a server. A Docker [image](https://hub.docker.com/r/drwetter/testssl.sh) is available\n* The simpe run is `docker run --rm -ti drwetter/testssl.sh [:]`\n\n## OpenSSL Timer\n* OpenSSL also provides an option to time SSL connections for a server: `openssl s_time -connect :`\n\n## Performance\n* Reference: OpenVPN Cookbook 2nd edition, Chpt. 8\n* Modern CPUs have the AES-NI instruction set which speeds up encryption\n* You can run `openssl` speed test with:\n - `openssl speed -evp aes-256-gcm` to test the `AES-256-GCM` cipher family\n - `openssl speed -evp aes-256-cbc` to test the `AES-256-CBC` cipher family\n - Use the `OPENSSL_ia32cap=0` environment variable to disable the `AES-NI` instruction set","has_starred","hub_user","kkalev13","immutable_tags_settings",{"_76":11,"_77":78},"enabled","rules",[79],".*","is_automated","permissions",{"_83":21,"_84":11,"_85":11},"read","write","admin","user","storage_size",318465159,"orgData",{"_91":92,"_93":94,"_95":96,"_97":33,"_98":33,"_99":100,"_101":102,"_103":104,"_105":106,"_107":108,"_109":108,"_110":108,"_111":21},"id","aa2c09da79234888be487bdd011d7303","uuid","aa2c09da-7923-4888-be48-7bdd011d7303","type","organization","orgname","full_name","location","Athens","company","Greek Universities Network (GUnet)","profile_url","http://www.gunet.gr","date_joined","2022-11-09T14:31:22.127551Z","gravatar_url","","gravatar_email","badge","is_active","recentTags",[114],{"_115":44,"_116":117,"_118":119,"_120":121,"_91":122,"_123":124,"_50":145,"_146":117,"_147":148,"_149":56,"_57":150,"_151":152,"_153":131,"_154":145,"_155":66,"_156":21},"content_type","creator",21147203,"digest","sha256:3f50e7e747b89a879235439a1a050341fc53d57fba3a0f6e8362e4888faaea8a","full_size",31804118,389252993,"images",[125,140],{"_126":127,"_118":128,"_129":108,"_130":131,"_132":133,"_134":135,"_136":108,"_137":-5,"_138":121,"_63":66,"_139":-5},"architecture","amd64","sha256:14f5bdcc17ce9ac8f5c987d09618c67170ea4ff7fb6093f353afd34e0cfcb763","features","last_pulled","2026-09-22T13:34:49.105120608Z","last_pushed","2024-08-26T11:10:39Z","os","linux","os_features","os_version","size","variant",{"_126":141,"_118":142,"_129":108,"_130":143,"_132":133,"_134":141,"_136":108,"_137":-5,"_138":144,"_63":66,"_139":-5},"unknown","sha256:bd5ed51513a2258454185dbadea94810317a2bffdfdd987b8dc0d952aa14935d","2026-09-13T22:22:52.104085851Z",9556,"2024-08-26T11:10:39.260511Z","last_updater","last_updater_username","gunetdocker","media_type","latest","repository",19270486,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_38":168,"_175":176,"_164":186,"_187":11},{"_40":169,"_42":170,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":171,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":73,"_74":172,"_80":11,"_81":174,"_86":33,"_87":88},[],[44],[56],{"_76":11,"_77":173},[79],{"_83":21,"_84":11,"_85":11},"tags",{"_177":64,"_178":-5,"_179":-5,"_180":181},"count","next","previous","results",[182],{"_115":44,"_116":117,"_118":119,"_120":121,"_91":122,"_123":183,"_50":145,"_146":117,"_147":148,"_149":56,"_57":150,"_151":152,"_153":131,"_154":145,"_155":66,"_156":21},[184,185],{"_126":127,"_118":128,"_129":108,"_130":131,"_132":133,"_134":135,"_136":108,"_137":-5,"_138":121,"_63":66,"_139":-5},{"_126":141,"_118":142,"_129":108,"_130":143,"_132":133,"_134":141,"_136":108,"_137":-5,"_138":144,"_63":66,"_139":-5},[],"canDeleteTags","actionData","errors"]

gunet/cert-req

Tags for gunet/cert-req