2

with Firefox it's easy to export the used SSL certificate of a page as x509 with all intermediate certificates as *.crt.

I'm in the need to do the same by converting *.pem files to *.crt as a non-binary format using openssl.

These are the current certs in use by apache:

SSLCertificateFile /etc/apache2/ssl/cert-start.pem
SSLCertificateKeyFile /etc/apache2/ssl/key-no-pw.pem
SSLCACertificateFile /etc/apache2/ssl/cert-bundle.pem

I can easily convert the SSLCertificateFile to crt with:

openssl x509  -in cert-start.pem -out cert-start.crt

To build the crt with full chain I've tried -chain, -clcerts without luck.

What is the correct way for including all intermediate certificates from SSLCACertificateFile /etc/apache2/ssl/cert-bundle.pemas well?

Improve this question
2
  • 2
    You mean this? #cat domain.tld.key domain.tld.crt root.crt > domain.tld.pem
    – Ergec
    Jun 18, 2019 at 11:39
  • openssl x509 -in cert-start.pem -out cert-start.crt does nothing (if no errors). cert-start.crt will have same content as cert-start.pem. openssl does not base its working on the filename. See documentation about -inform and -outform. But note that .pem and .crt extensions (or even .cert) are pure conventions, and mostly interchangeable. No respectable tool base its workings on this. PEM is a format (on how to store the content) and crt is just a human memoniker for certificate. Certificates can be encoded in PEM fornat, but other things can too.
    – Patrick Mevzek
    Jun 19, 2019 at 20:17

2 Answers 2

Reset to default
2 
cat cert-start.pem cert-bundle.pem > chain.pem

in case it would contain also the key (in some cases it is needed but depends on usage) ot would be

cat cert-start.pem cert-bundle.pem key-no-pw.pem > full_chain.pem

In case you would check the output you will see something like this (in case of chain.pem):

-----BEGIN CERTIFICATE-----
 ... <base64 encoded server cert> ...
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
 ... <base64 encoded intermediate cert> ...
-----END CERTIFICATE-----

And in case of of full_chain.pem it will be something like this:

-----BEGIN CERTIFICATE-----
 ... <base64 encoded server cert> ...
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
 ... <base64 encoded intermediate cert> ...
-----END CERTIFICATE-----

-----BEGIN PRIVATE KEY-----
 ... <base64 encoded key>
-----END PRIVATE KEY-----

In case you would "check" it using openssl x509 -in chain.pem you will see just the first (in this case server) certificate. All the rest will be handled as comment - ignored. You have to separate it to extra file or just print specific line range via pipe to openssl to see the content. The real check can be done "visually" using cat or some text editor you prefer... Once the application expect pem / crt file this is what you need.

In case you would like to handle it as "container" the proper form is pkcs12. There you can handle it as set of certificates and handle it that way and see it / import it. The command would be in that case

openssl pkcs12 -export -in cert-start.pem -inkey key-no-pw.pem -certfile cert-bundle.pem -out full_chain.p12 -nodes

The pkcs12 output can be checked using command

openssl pkcs12 -in full_chain.p12 -nodes

Please note that "correct" format (p12 or pem / crt) depends on usage.

Improve this answer
0
3

You simply concatenate them

cat domain.tld.key domain.tld.crt root.crt > domain.tld.pem
Improve this answer
1
  • thanks. In my case, I this would read: cat cert-bundle.pem cert-start.pem > domain.tld.pem followed by openssl x509 -in domain.tld.pem -out out.crt unfortunately this does not include the intermediate certs from cert-bundle.pem into out.crt. I think I miss something really obvious.
    – Anatol
    Jun 18, 2019 at 11:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .