I want to take my website SSL certificate and sign a message so someone else can take my website SSL certificate and my message and verify it was signed using my certificate.

How can I sign a message using my SSL website certificate?

  • 3
    You can't. SSL certs are used to secure domains, not to sign messages. – DavidPostill May 10 '18 at 19:19
  • 1
    @David No, technically you certainly could do that (after all, the way certificates "secure domains" is by making digital signatures during the TLS handshake)... The receiver might not accept the signature due to mismatching extendedKeyUsage though. And I only know how to do this via openssl, not via Windows CAPI. – grawity May 10 '18 at 20:05
  • @grawity, if you want to provide an answer for openssl, I'll accept it. It will lay down the general idea and then I can extrapolate it to other environments like windows. These days there's a tool for just about everything. Note that, as you mentioned, I don't care about what the "message" is, as long as I can sign it and they can verify it. Thanks! – toddmo May 10 '18 at 20:12
  • 1
    @toddmo Check out stackoverflow.com/questions/10782826/… – Bora May 12 '18 at 4:42
  • @DavidPostill, I'm not understanding your comment, since I just signed and verified a message using my domain SSL cert. What exactly are you saying I can't do? Can you clarify? I posted an answer showing what I did. – toddmo May 14 '18 at 1:04

This turned out to be straight forward. The credit goes to https://stackoverflow.com/a/18359743/1045881. I just rewrote it for newbies like me.

Let's say the site is example.com


Getting your certificate

If you are on the signature side, you control your certificate. you can follow the good instructions at: https://www.thawte.nl/en/support/manuals/microsoft/all+windows+servers/export+private+key+or+certificate/

This will give you your private key and the certificate needed for the following steps.

If you are just on the verify side, you can click on the lock next to the web address in your browser and view the certificate, and export it base64 to a crt or a cer file. The filename is not important but domain.crt is a good name.

Install openssl

Install openssl. I used https://indy.fulgan.com/SSL/ referred to me by https://wiki.openssl.org/index.php/Binaries. Extract it into a openssl installation folder. I'll call this the openssl folder.

Run openssl

just go to your openssl folder and type openssl and hit enter. Now you are in an openssl prompt.


You need your private key. It looks like this:

(bunch of base64 text)==

Save it in for example example.key. But the file name is not important, just helpful.

Then save a message into a file called message.txt. It can be empty. And file name is not important.

Then in your openssl folder (where you extracted the binaries), run

dgst -sha256 -sign example.key -out signature.txt message.txt

it uses the message and the key to produce the signature.

message + key => signature


You will need the site's certificate. It looks like this:

(bunch of base64)==

Save it into example.crt. The name doesn't matter.

First, you will need to create a public key from the certificate file (example.crt) like this:

x509 -in example.crt -pubkey -noout -out example.pub

This uses the certificate to create the public key.

certificate => public key

Then you can verify the message like this:

dgst -sha256 -verify example.pub -signature signature.txt -out result.txt message.txt

It uses the public key and the signature to verify the message, putting the verification result into the file result.txt.

public key + signature + message => result

result.txt will contain either "Verified OK" or "Verification Failure".


Instructions coming soon. I think it's pretty similar except minor syntax.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.