How can I update existing .crt file with new encrypted rsa .key file?

Question

Suppose I have 2 files: an RSA key file client.key and a certification file client.crt.

I have created them without pass-phrase and now I have encrypted client.key file with pass-phrase by command:

openssl rsa -des3 -in client.key -out client-enc.key

Now I want to re-create/update client.crt file with client-enc.key. How can I do that?

Answer 1

I don't believe you need to. The .crt file only contains the public half of the key, it does not contain a copy of the private key, and you haven't changed the content of the private key anyway — you've just wrapped it inside a symmetric encryption layer (decrypted by the passphrase). Why do you believe you need to update the certificate?

Answer 2

A certificate contains a public key and signatures of this public key. This is not confidential information; sometimes you might not want to reveal it for privacy, but this isn't a common enough concern that there would be a specific certificate encryption format. If you want to encrypt the certificate, use your favorite encryption tool, e.g. PGP/GPG.

Is your concern that you've changed the key? If so, you're confused as to what the key and certificate represent, and since this is a rather important matter, I advise reading more on the topic.

• If you've only put a password on the key file, that's something you did to the key file, i.e. to the medium in which you stored the key. The encryption of the private key file is an independent operation, not directly related to the fact that the file contains a private key. But because protecting a private key for confidentiality is a very common requirement, there is a standard format and an openssl command for doing that. The key is the same, but this particular copy of the key now requires a password to be read.
• If you had actually changed the private key (which, from your description, you haven't!), you would have to regenerate the certificate from scratch. The fact that a public key only corresponds to one particular private key is fundamental in public-key cryptography: the public key represents your identity, and (knowledge of) the private key is the way you prove your identity.