with Firefox it's easy to export the used SSL certificate of a page as x509 with all intermediate certificates as *.crt.

I'm in the need to do the same by converting *.pem files to *.crt as a non-binary format using openssl.

These are the current certs in use by apache:

SSLCertificateFile /etc/apache2/ssl/cert-start.pem
SSLCertificateKeyFile /etc/apache2/ssl/key-no-pw.pem
SSLCACertificateFile /etc/apache2/ssl/cert-bundle.pem

I can easily convert the SSLCertificateFile to crt with:

openssl x509  -in cert-start.pem -out cert-start.crt

To build the crt with full chain I've tried -chain, -clcerts without luck.

What is the correct way for including all intermediate certificates from SSLCACertificateFile /etc/apache2/ssl/cert-bundle.pemas well?

  • 1
    You mean this? #cat domain.tld.key domain.tld.crt root.crt > domain.tld.pem – Ergec Jun 18 '19 at 11:39
  • openssl x509 -in cert-start.pem -out cert-start.crt does nothing (if no errors). cert-start.crt will have same content as cert-start.pem. openssl does not base its working on the filename. See documentation about -inform and -outform. But note that .pem and .crt extensions (or even .cert) are pure conventions, and mostly interchangeable. No respectable tool base its workings on this. PEM is a format (on how to store the content) and crt is just a human memoniker for certificate. Certificates can be encoded in PEM fornat, but other things can too. – Patrick Mevzek Jun 19 '19 at 20:17
cat cert-start.pem cert-bundle.pem > chain.pem

in case it would contain also the key (in some cases it is needed but depends on usage) ot would be

cat cert-start.pem cert-bundle.pem key-no-pw.pem > full_chain.pem

In case you would check the output you will see something like this (in case of chain.pem):

 ... <base64 encoded server cert> ...

 ... <base64 encoded intermediate cert> ...

And in case of of full_chain.pem it will be something like this:

 ... <base64 encoded server cert> ...

 ... <base64 encoded intermediate cert> ...

 ... <base64 encoded key>

In case you would "check" it using openssl x509 -in chain.pem you will see just the first (in this case server) certificate. All the rest will be handled as comment - ignored. You have to separate it to extra file or just print specific line range via pipe to openssl to see the content. The real check can be done "visually" using cat or some text editor you prefer... Once the application expect pem / crt file this is what you need.

In case you would like to handle it as "container" the proper form is pkcs12. There you can handle it as set of certificates and handle it that way and see it / import it. The command would be in that case

openssl pkcs12 -export -in cert-start.pem -inkey key-no-pw.pem -certfile cert-bundle.pem -out full_chain.p12 -nodes

The pkcs12 output can be checked using command

openssl pkcs12 -in full_chain.p12 -nodes

Please note that "correct" format (p12 or pem / crt) depends on usage.

  • thanks this worked and helped a lot ;) – t Book Jun 18 '19 at 14:55

You simply concatenate them

cat domain.tld.key domain.tld.crt root.crt > domain.tld.pem
  • thanks. In my case, I this would read: cat cert-bundle.pem cert-start.pem > domain.tld.pem followed by openssl x509 -in domain.tld.pem -out out.crt unfortunately this does not include the intermediate certs from cert-bundle.pem into out.crt. I think I miss something really obvious. – t Book Jun 18 '19 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.