7

I have a .pem private key generated by openssl. How to extract the key ID from it?

Edit: the generated rsa keypair is for Amazon cloudfront. When uploaded on the console, a 'Key ID' is displayed. However the private key I have generated is not for my account and I don't have any slot available to upload the public key on my AWS account (there's a limit of 2 public keys).

Improve this question
2
  • 1
    Is there any specific program that requires you to enter such a key ID?
    – u1686_grawity
    Sep 27, 2011 at 11:52
  • @user1686 In my use case, I am trying to recover cert/key relationships in an unfamiliar PKI environment. It would be easier if I could look at what's there and confirm relationships using these IDs.
    – Brian Topping
    Oct 30, 2021 at 18:07

4 Answers 4

Reset to default
14

Bare keys do not have "key IDs". They're just series of numbers.

If the key belongs to an X.509 certificate, then the certificate's fingerprint (a SHA-1 hash of the DER-encoded cert) will be used for identification: openssl x509 -outform der | openssl sha1, or openssl x509 -noout -fingerprint.

Otherwise (if it's just a bare public/private keypair), the SHA-1 hash of the public key is used sometimes (again, DER encoding), but I don't know of any standard for it. You can extract the public key with openssl rsar -pubout -outform der, again piping to openssl sha1 if that's what your program requires.

The "key pair IDs" used by CloudFront are serial numbers of the database entry with that key. The same key, uploaded twice, will have different IDs; I just tested it.

Improve this answer
3
  • thanks. I have edited my question. It looks like the way to generate this AWS 'key ID' is proprietary, so my question is just plain wrong...
    – ascobol
    Sep 27, 2011 at 12:49
  • CloudFront key IDs are indeed proprietary; see updated answer.
    – u1686_grawity
    Sep 27, 2011 at 12:57
  • Try using the -sha256 option. See stackoverflow.com/questions/55847788/… for details.
    – Michael Behrens
    Feb 13, 2021 at 23:21
2

Amazon now provides tools for performing such actions on any server (not just servers running in EC2). On any Ubuntu computer you can install the tools with apt-get:

$ sudo apt-get install ec2-ami-tools ec2-api-tools

Here is the syntax to get the fingerprint for My.pem:

$ ec2-fingerprint-key My.pem
62:44:56:f7:91:f2:8b:9b:44:7c:17:0e:39:c7:34:68:f5:b2:3c:57

As ec2-fingerprint-key is a bit long to type, there is an equivalent shortcut ec2fp:

$ ec2fp My.pem
62:44:56:f7:91:f2:8b:9b:44:7c:17:0e:39:c7:34:68:f5:b2:3c:57
Improve this answer
0

Use below command to get KID/fingerprint

openssl x509 -in <certificate_file> -fingerprint -noout|cut -f2 -d '='| tr -d ':'
Improve this answer
-1

The kid does have a standard behind it, but some options are left to the client, which is why the client has a responsibility to maintain it https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.2

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .