For test purposes (i.e. all self signed, not production), how would I use openssl to create a PEM file which contains the private key, the associated public certificate, and the certificate chain all the way to the root certificate?
2 Answers
You generally don't put a private key in a PEM, because private keys should be encrypted "at rest" (on disk), and PEM is generally for non-encrypted objects.
You generally put a private key, and its associated cert chain, in a .p12 / .pfx (PKCS#12) file.
I think it goes something like this (caveat lector: I haven't tried this myself, YMMV):
openssl pkcs12 -export -in file.pem -inkey keyfile.pem -chain -out file.p12
-
Thanks for the response. The vendor said they want a .pem file, and my mistake, the private key should not be in there.– SeanLabsDec 1, 2015 at 23:08
-
hello, if i want to convert all 4 files (cert.pem, chain.pem, fullchain.pem and privkey.pem) to a pfx how can i write the code? Jun 3, 2022 at 6:37
Is really unsafe to put private key(private means private) in a pem file. But if you want to do this is the procedure, the risk is high, only use in controlled/testing environment. Use in production mean "safety=I don't know this word".
a)first create the self signed keypair of public(cert.pem) and private(key.pem)
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days `echo 365*4|bc -l` -subj "/C=US/ST=Delaware/L=Delaware/O=SELFSIGNED/CN=`hostname -f`"
b)then remove the password from key.pem(when asked put the password selected in the previous command)
openssl rsa -in key.pem -out newkey.pem && mv key.pem key.pem.old && mv newkey.pem key.pem
c)is not necessary, but dhparam is not a bad idea
openssl dhparam -out dhparams.pem 2048
d)finally we create the final.pem, that contain public and private(sic!) keys
cat key.pem cert.pem dhparams.pem > final.pem