thaker/openssl repository overview

⁠Description

This image generates a self signed certificate for https in development environments. It will create a .pfx, .key and a .crt file. So you can easily use it on windows too.

The pfx file is in pkcs12 format and is protected by a password. It includes the public and private key of the certificate. The .crt file is just the public part in x509 text format. The .key file is the unprotected rsa key in text format.

⁠Example usage

Make sure to provide the destination directory for the certificates using a volume. You may use it like this:

docker run --rm -e CERT_PASSWORD=pwd1234 -e CERT_NAME=certname -e CN=domain.example.com -v c:/certificates/:/openssl-certs thaker/openssl

It will create the .pfx, .crt and .key file to the c:/certificates/ directory. Note that only the .pfx file is protected by the password. The .key file is not protected by the password which makes it easily usable by nginx or apache webserver.

⁠How to import the certificate

⁠Windows

If you use windows, you can run the following commands to import the certificate to your machine cert store:

certutil -p pwd1234 -importPFX c:/certificates/certname.pfx

You can also use the Import-PfxCertificate powershell module like this:

  $secure = ConvertTo-SecureString pwd1234 -AsPlainText -Force
  Import-PfxCertificate -FilePath "c:/certificates/certname.pfx" -Password $secure -CertStoreLocation Cert:\LocalMachine\My
  Import-PfxCertificate -FilePath "c:/certificates/certname.pfx" -Password $secure -CertStoreLocation Cert:\LocalMachine\AuthRoot

Note that the .pfx file contains both the private and public part of the certificate. If you wish to only trust the certificate, import the public part (.crt) file to your cert store instead.

⁠Linux

For linux the public and private key are split into separate files so you can put them into different directories:

• Public key: Move the .crt to /etc/ssl/certs
• Private key: Move the .key to /etc/ssl/private

Make sure to restrict access (chmod) of the private key (.key). You can use chmod 600 certname.key

If you use ca-certificates (for example when using ubuntu) you should rather move the public key (.crt) to /usr/share/ca-certificates/xyz where xyz is a directory name of your choice. After runningupdate-ca-certificates the certificate will automatically be added to /etc/ssl/certs and also be included in the bundled cert store at /etc/ssl/certs/ca-certificates.crt

⁠Testing the certificates

You can test whether the private key matches the public key by using the following commands:

openssl x509 --noout --modulus --in certname.crt | openssl md5
openssl rsa --noout --modulus --in certname.key | openssl md5

You can also test the pfx file but you must first convert it to a .key file:

openssl pkcs12 -in certname.pfx -nocerts -nodes -passin pass:pwd1234 | openssl rsa --noout --modulus | openssl md5

⁠Converting the certificate

If you lost your .key or .crt file you can simply recreate them from your .pfx file and vice versa using the following commands:

## .pfx to .key
openssl pkcs12 -in certname.pfx -nocerts -nodes -passin pass:pwd1234 | openssl rsa -out certname.key

## .pfx to .crt
openssl pkcs12 -in certname.pfx -nokeys -nodes -passin pass:pwd1234 | openssl x509 -out certname.crt

## .key / .crt to .pfx
openssl pkcs12 -export -out certname.pfx -inkey certname.key -in certname.crt -passout pass:pwd1234

## .pfx to .pem (includes private and public part)
openssl pkcs12 -in certname.pfx -out certname.pem -nodes -passin pass:pwd1234

## .pem to .key
openssl rsa -in certname.pem -out certname.key

## .pem to .crt
openssl x509 -in certname.pem -out certname.crt

## .key / .crt to .pem (just concatenate them)
cat certname.crt certname.key >certname.pem