OpenSSL signing with PEM and an ALIAS

Question

I need to directly ask this here because after much Googling and searching on StackExchange, I haven't landed on anything relevant so far.

So, say I am using OpenSSL (on a Windows platform, if that matters) and a .pem file to sign a .txt file; the command I use is

openssl smime -sign -in unsignedfile.txt -outform der -binary -nodetach -out signedfile.txt.p12 -signer certificate.pem -passin pass:PASSWORD

So far, so good.

My question is: should the .pem file contain MORE THAN ONE pairs of privatekey/certificate - each of them identified by a "friendlyName" (which I understand being an alias, an identifier), how do I specify the alias I want to use in the command line above?

Is that even possible?

Been looking for the -alias option at https://wiki.openssl.org/index.php/Command_Line_Utilities but didn't help much.

Thank you in advance.

Answer 1

Not possible.

PEM files in general can contain more than one 'object', but most OpenSSL commandline operations, including this one, only use the first one of the desired type -- the first key in a key file, the first cert in a cert file, etc. In particular if you need both a privatekey and a cert, as smime -sign does, you can read both the (first) key and the (first) cert from a single file. A few operations or options use all the certs in a file, but even there you can't select a specific one other than the first.

A PKCS12 file contains structured data that can associate various attributes including 'friendlyname' with a key and cert. When you 'import' a PKCS12 with openssl pkcs12 -in file.p12 ... the output contains those attributes, but in PEM format they are only comments and ignored, like everything else that is not within a valid ----BEGIN x to -----END x block. Similarly when you create a PKCS12 using openssl pkcs12 -export -out file.p12 ... you can specify friendlyname values to go in the PKCS12 as commandline options, but any that are in the PEM input are ignored. (You can't specify any other attributes, although localkeyid is generated automatically.)

You could use awk or similar to select the desired block(s) from the file, something like

awk -vwant=smeagol '/friendlyName:/{sel=($2==want)} /^-----BEGIN/,/^-----END/{if(sel)print}' <manyPEM >onePEM
# and then use onePEM

PS: the data structure output by smime -outform der is CMS, which is derived from and often still called PKCS7. Not PKCS12, which is very different. Naming it .p12 is likely to confuse and mislead people, such as your own future self.