SSL CSR with OpenSSL and Response

Create the CSR and Private Key now

	openssl req -out sslcert.csr -newkey rsa:2048 -nodes -keyout private.key -config san.cnf

	openssl req -noout -text -in sslcert.csr | grep DNS

	[root@Chandan test]# openssl req -noout -text -in sslcert.csr | grep DNS
               DNS:bestflare.com, DNS:usefulread.com, DNS:chandank.com
	[root@Chandan test]#

	openssl pkcs12 -export -in <CAreply> -inkey private.key 
	  -certfile <intermediates.cert.pem> -name "www.lemmermann.tech" 
	  -out www.lemmermann.tech.p12

https://support.code42.com/Administrator/6/Configuring/Use_OpenSSL_to_install_a_keystore

https://geekflare.com/san-ssl-certificate/

Create pfx file from CA Response

openssl pkcs12 -export -in www_crouse_org.crt -inkey www_crouse_org.key  -name "www.crouse.org"  -out www.crouse.org.pfx
    -certfile <intermediates.cert.pem> 

Updated 2020-02-15 with newer instructions that make more sense

# WinSCP the wildcard cert (at time of writing), 2018-19-Wildcard.pfx, to the ~/

# WinSCP the intermediate cert to ~/

# You will need the password for the root combo pfx

# Copy the intermediate to its home (If applicable)

sudo cp ~/intermediate.crt /etc/apache2/ssl/intermediate.crt

# Export public key

openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [public.key]

# Copy the public key to its home

sudo cp ~/public.key /etc/apache2/ssl/public.key

# Extract the Private cert from the pfx

openssl pkcs12 -in [yourfile.pfx] -nocerts -out [private-encrypted.key]

# Copy the private key to its home

sudo cp ~/private-encrypted.key /etc/apache2/ssl/private-encrypted.key

# This will remove the key so that Apache2 can start without having to sign in to paste in the key

sudo openssl rsa -in ~/private-encrypted.key -out /etc/apache2/ssl/private.key

# Restart Apache2

sudo /etc/init.d/apache2 restart

https://www.markbrilman.nl/2011/08/howto-convert-a-pfx-to-a-seperate-key-crt-file/

https://stackoverflow.com/questions/15413646/converting-pfx-to-pem-using-openssl

https://serverfault.com/questions/160768/stop-apache-from-asking-for-ssl-password-each-restart

PEM with RSA Private key (ie NetScaler)

Example with this: snet.crouse.org_password.pfx

openssl pkcs12 -in snet.crouse.org_password.pfx -out snet.crouse.org_2020.pem -nodes

openssl rsa -outform der -in  snet.crouse.org_2020.pem -out  snet.crouse.org_2020_rsa_private.key

penssl x509 -outform der -in snet.crouse.org_2020.pem -out snet.crouse.org_2020_private.cer

https://discussions.citrix.com/topic/397777-netscaler-ver-121-cannot-import-ssl-pfx-error-no-certificates-present-in-the-certificate-bundle-file-rapidssl-digicert-entrust/

How to get .pem file from .key and .crt files?

openssl rsa -in server.key -text > private.pem

openssl x509 -inform PEM -in server.crt > public.pem

Remove password from a PFX file

openssl pkcs12 -in pfx.pfx -nodes | openssl pkcs12 -export -keypbe NONE -certpbe NONE -out output.pfx

https://security.stackexchange.com/questions/195080/how-to-convert-my-cert-chain-to-pfx-without-a-password  

Get all Trusted Root Certs ,trusted

# Use rootups on Windows to download all Trusted Root Authorities

# Select all and export with a key

# SCP to Linux box

# Copy your certificate in PEM format (the format that has ----BEGIN CERTIFICATE---- in it)

sudo openssl pkcs12 -in AllRoots.pfx -out /usr/local/share/ca-certificates/allroots.crt -cacerts

# into /usr/local/share/ca-certificates and name it with a .crt file extension.

sudo update-ca-certificates.

Validate cert chain of website

openssl s_client -showcerts -connect www.domain.com:443

PFX to PEM, quickly

openssl pkcs12 -in d:\Temp\cert.pfx -out d:\Temp\cert.pem -nodes

The -nodes removes the password from the created PEM file. If you wish to maintain the password encryption omit the -nodes however this may make it difficult to use the PEM file on your device. You will be prompted to type the password for the pfx file.

https://www.itprotoday.com/windows-78/converting-certificate-files-pfx-format-pem

DER to CRT/PEM (to base64), quickly

As you have the openssl tag on your question, you should use:

openssl x509 -inform der -in infile.cer -out outfile.cer

In the reverse direction:

openssl x509 -outform der -in infile.cer -out outfile.cer

.

Apache ReWrite to SSL

$ sudo a2enmod rewrite 

Put this in your *:80 section of your config

RewriteEngine On

RewriteCond %{HTTPS} !on

RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Grab all subject alt name from a cert

Example with "google.com":

# Get all certs in a chain

openssl s_client -showcerts -verify 5 -connect $1:443 < /dev/null |

   awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN CERTIFICATE/){a++}; out="cert"a".pem"; print >out}'

for cert in *.pem; do 

        newname=$(openssl x509 -noout -subject -in $cert | sed -nE 's/.*CN ?= ?(.*)/\1/; s/[ ,.*]/_/g; s/__/_/g; s/_-_/-/; s/^_//g;p' | tr '[:upper:]' '[:lower:]').pem

        echo "${newname}"; 

         # mv "${cert}" "${newname}" 

done

List Cert details

echo quit | openssl s_client -showcerts -servername $1 -connect $1:443 > cacert.pem

LetsEncrypt Certificate Request
sudo certbot run -a manual -i apache -d cal.lemmermann.tech