openssl : How to create .pem file with private key, associated public certificate, and certificate chain all the way to the root certificate?

Question

For test purposes (i.e. all self signed, not production), how would I use openssl to create a PEM file which contains the private key, the associated public certificate, and the certificate chain all the way to the root certificate?

Answer 1

You generally don't put a private key in a PEM, because private keys should be encrypted "at rest" (on disk), and PEM is generally for non-encrypted objects.

You generally put a private key, and its associated cert chain, in a .p12 / .pfx (PKCS#12) file.

I think it goes something like this (caveat lector: I haven't tried this myself, YMMV):

openssl pkcs12 -export -in file.pem -inkey keyfile.pem -chain -out file.p12

Answer 2

Is really unsafe to put private key(private means private) in a pem file. But if you want to do this is the procedure, the risk is high, only use in controlled/testing environment. Use in production mean "safety=I don't know this word".

a)first create the self signed keypair of public(cert.pem) and private(key.pem)

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days `echo 365*4|bc -l` -subj "/C=US/ST=Delaware/L=Delaware/O=SELFSIGNED/CN=`hostname -f`"

b)then remove the password from key.pem(when asked put the password selected in the previous command)

openssl rsa -in key.pem -out newkey.pem && mv key.pem key.pem.old && mv newkey.pem key.pem

c)is not necessary, but dhparam is not a bad idea

openssl dhparam -out dhparams.pem 2048

d)finally we create the final.pem, that contain public and private(sic!) keys

cat key.pem cert.pem dhparams.pem > final.pem