I want to take my website SSL certificate and sign a message so someone else can take my website SSL certificate and my message and verify it was signed using my certificate.
How can I sign a message using my SSL website certificate?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
This turned out to be straight forward. The credit goes to https://stackoverflow.com/a/18359743/1045881. I just rewrote it for newbies like me.
Let's say the site is
If you are on the signature side, you control your certificate. you can follow the good instructions at: https://www.thawte.nl/en/support/manuals/microsoft/all+windows+servers/export+private+key+or+certificate/
This will give you your private key and the certificate needed for the following steps.
If you are just on the verify side, you can click on the lock next to the web address in your browser and view the certificate, and export it base64 to a crt or a cer file. The filename is not important but
domain.crt is a good name.
just go to your openssl folder and type
openssl and hit enter. Now you are in an
You need your private key. It looks like this:
-----BEGIN RSA PRIVATE KEY----- (bunch of base64 text)== -----END RSA PRIVATE KEY-----
Save it in for example
example.key. But the file name is not important, just helpful.
Then save a message into a file called
message.txt. It can be empty. And file name is not important.
Then in your openssl folder (where you extracted the binaries), run
dgst -sha256 -sign example.key -out signature.txt message.txt
it uses the message and the key to produce the signature.
message + key => signature
You will need the site's certificate. It looks like this:
-----BEGIN CERTIFICATE----- (bunch of base64)== -----END CERTIFICATE-----
Save it into
example.crt. The name doesn't matter.
First, you will need to create a public key from the certificate file (
example.crt) like this:
x509 -in example.crt -pubkey -noout -out example.pub
This uses the certificate to create the public key.
certificate => public key
Then you can verify the message like this:
dgst -sha256 -verify example.pub -signature signature.txt -out result.txt message.txt
It uses the public key and the signature to verify the message, putting the verification result into the file
public key + signature + message => result
result.txt will contain either "Verified OK" or "Verification Failure".
Instructions coming soon. I think it's pretty similar except minor syntax.