Certificate Commands

---

Certificate Command References

The below commands are meant to serve as a centralized reference for working with Certificates. They focus on extractions and conversions mostly.

OpenSSL Certificate Generation

# Generate a self signed certificate openssl req -newkey rsa:2048 -nodes -keyout servername.key -x509 -days 365 -out servername.crt # Generate Private Key openssl genrsa -out yourdomain.key 2048 # Generate CSR openssl req -new -key yourdomain.key -out yourdomain.csr # Generate CSR and Private Key openssl req -new -newkey rsa:2048 -nodes -keyout servername.key -out servername.csr -subj "/C=US/ST=New Jersey/L=Newark/O=OsbornePro LLC., Inc./OU=Certificates/CN=osbornepro.com" # Complete CSR Request openssl x509 -signkey servername.key -in servername.csr -req -days 365 -out servername.crt # Generate Certificate from existing private key openssl req -key servername.key -new -x509 -days 365 -out servername.crt -subj "/C=US/ST=New Jersey/L=Newark/O=OsbornePro LLC., Inc./OU=Certificates/CN=osbornepro.com" # Encrypt private key openssl rsa -in unencrypted.key -out encrypted.key # Decrypt private key openssl rsa -in encrypted.key -out unencrypted.key

Check Certificate Files

# Check Private Key openssl rsa -in yourdomain.key -check # Check CSR openssl req -text -noout -verify -in CSR.csr # Check Certificate openssl x509 -in certificate.crt -text -noout # Verify CA Signing openssl verify -verbose -CAFile ca.crt domain.crt # Check PKSC#12 openssl pkcs12 -info -in keyStore.p12

OpenSSL Conversion Commands

# Convert PEM to DER openssl x509 -outform der -in certificate.pem -out certificate.der # Convert PEM to P7B openssl crl2pkcs7 -nocrl -certfile certificate.cer -out certificate.p7b -certfile CACert.cert #Convert PEM to PFX openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt # Convert PKCS #7 (P7B) and private key to PKCS #12 / PFX openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.cer # Convert DER certificate file openssl x509 -inform DER -in yourdomain.der -outform PEM -out yourdomain.crt # Convert private key file openssl rsa -inform DER -in yourdomain_key.der -outform PEM -out yourdomain.key #Convert P7B to PEM openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer # Convert P7B to PFX openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.cer Converting PKCS #12 / PFX to PKCS #7 (P7B) and private key openssl pkcs12 -in certificate.pfx -out certificate.cer -nodes # Extract PFX certificate file openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.cer -passin pass:"Password123!" # Extract PFX private key file openssl pkcs12 -in ertificate.pfx -nocerts -nodes -out certificate.cer -passin pass:"Password123!" # Extract PFX Encrypted Private key file openssl pkcs12 -in domain.pfx -nocerts -out enc.key # Decrypt that key openssl rsa -in enc.key -out key.key # Extract PFX CA Chain openssl pkcs12 -in yourdomain.pfx -cacerts -nokeys -chain -out cachain.pem -passin pass:"Password123!"

PowerShell Certificate Conversions

# Import PFX Certificate Import-PfxCertificate -FilePath "C:\Temp\domain.pfx" -CertStoreLocation "Cert:\LocalMachine\My" -Confirm:$False -Password (ConvertTo-SecureString -String "Password123!" -AsPlainText -Force) -Exportable # Public Certificate extraction method $CertDestination = "$env:TEMP\cert.cer" $Wc = Get-ChildItem -Path cert:\LocalMachine\My\$($Certificate.Thumbprint) Export-Certificate -Cert $Wc -FilePath cert.cer -Type CERT -Force # Convert to a Base64 format certificate file for DER format Start-Process -FilePath "C:\Windows\System32\certutil.exe" -ArgumentList @("-f", "-encode", $CertDestination.Replace(".crt", ".cer"), $CertDestination) -Wait -WorkingDirectory "C:\Windows\System32" -NoNewWindow -Confirm:$False # Combine Public Certificate and Private Key file into PFX (.cer and .key extensions are required and need to exist in the same directory) certutil -MergePFX public-certificate.cer combined-certs.pfx # Extract CA Chain from Certificate store $CAR = Get-ChildItem -Path Cert:\LocalMachine\CA\$($CARoot.Thumbprint) $InterCA = Get-ChildItem -Path Cert:\LocalMachine\CA\$($CAIntermediate.Thumbprint) Export-Certificate -Cert $CAR -FilePath ca.cer -Type CERT -Force Export-Certificate -Cert $InterCA -FilePath intermediate.cer -Type CERT -Force # Convert Extracted Certs to Base64 Format certutil -encode ca.cer ca.pem certutil -encode intermediate.cer intermediate.pem # Combine Above CA Certs into One File Get-Content -Path ca.pem | Out-File -FilePath cachain.pem -Encoding utf8 -Force Get-Content -Path intermediate.pem | Out-File -FilePath cachain.pem -Encoding utf8 -Append -Force # Extracting the Full CA Chain from a PFX file $AllCACerts = @() $CADestination = $env:TEMP\root.pem" $Chain = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Chain $Chain.Build((Get-PfxCertificate -FilePath $PfxFilePath)) $Chain.ChainElements | ForEach-Object { Export-Certificate -FilePath $CADestination -Cert $_.Certificate -Type CERT -Force | Out-Null Start-Process -FilePath "C:\Windows\System32\certutil.exe" -ArgumentList @("-f", "-encode", $CADestination.Replace(".crt", ".cer"), $CADestination) -Wait -WorkingDirectory "C:\Windows\System32" -NoNewWindow -Confirm:$False $AllCACerts += Get-Content -Path $CADestination -Force } # End ForEach-Object Set-Content -Path $CADestination -Value $AllCACerts Get-Content -Path $CADestination # USE PSPKI MODULE FOR CERT EXTRACTIONS $CertifyPath = "C:\ProgramData\Certify\assets\_.$env:USERDNSDOMAIN\" $SecurePassword = ConvertTo-SecureString -String $String -Force –AsPlainText # Extracting Certificate and Key into single file" Convert-PfxToPem -InputFile domain.pfx -Outputfile ("$CertifyPath" + "key.pem") -Password (ConvertTo-SecureString -String "Password123!" -AsPlainText -Force) # Separating certificate and key too separate files" $FileContents = Get-Content -Path ("$CertifyPath" + "key.pem") -Raw $FileContents -Match "(?ms)(\s*((?<privatekey>-----BEGIN PRIVATE KEY-----.*?-----END PRIVATE KEY-----)|(?<certificate>-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----))\s*){2}" $Matches["privatekey"] | Out-File -FilePath "$Path\key.pem" -Force $Matches["certificate"] | Out-File -FilePath "$Path\cert.pem" -Force

Certutil Certificate Conversions

# Create PFX from cer file # 1.) Private key file REQUIRES .KEY extension and must exist in the same directory # 2.) Certificate and private key files REQUIRE the same file name (With the exception of .key) certutil –MergePFX certfile.cer certfile.pfx # Generate CSR Request certreq.exe -new -q -config "ca.osbornepro.com\OsbornePro CA" policy.inf request.csr # Complete CSR Request certreq.exe -submit -q -config "caserver.osbornepro.com\OsbornePro CA" request.csr response.cer cert.p7b response.ful # Cert Request Policy File (policy.inf) [Version] Signature = "$WindowsNT$" [NewRequest] Subject = "CN=web.osbornepro.com,OU=Certificates" Exportable = TRUE KeyLength = 2048 [RequestAttributes] CertificateTemplate=WebServer [Extensions] 2.5.29.17 = "{text}" _continue_ = "dns=web.osbornepro.com&"