Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to setup certificates for a web server (Splunk, in particular), and don't think I have them in the right format. I need to provide the path to a private key file, and a CA certificate. Right now, I have both of those in PEM format (the contents of both files start with "----BEGIN CERTIFICATE-----"). But that doesn't seem to be working, and my best guess is that the private key file needs to be in a different format. Basically, I'd like to have it in a format such that the command

openssl rsa -in MYFILE -check 

succeeds (right now, that fails with "unable to load Private Key"). I can, however, currently verify it with

openssl x509 -in MYFILE -text -noout

So how can I convert the file so that the first command succeeds on it?

share|improve this question

2 Answers 2

up vote 12 down vote accepted

A certificate has only the public key, not the private one.

When they're in PEM format, sometimes both the private key and the certificate are in the same file. Look for a BEGIN PRIVATE KEY or BEGIN RSA PRIVATE KEY header. If you find one, just separate the two blobs using a regular text editor.

But if you have only the certificate, then you absolutely cannot get a private key out of it. A certificate has only the public key, and the entire security of asymmetric cryptography depends on the impossibility of finding the private key given the public one.

share|improve this answer

It sounds like you have both the private key and cert in .pem format (X509) and need to convert that private key to the rsa private key format (RSA)

A method to do that has been provided here:

http://stackoverflow.com/questions/17733536/how-do-i-convert-a-private-key-to-an-rsa-private-key

share|improve this answer
    
The private key with a BEGIN PRIVATE KEY header is technically in PKCS#8 format – X.509 is strictly about certificates. –  grawity Apr 8 at 16:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.