As the title says:
Using OpenSSL, how do I generate a self-signed certificate in DER format which includes the private key? Is this possible at all?
I have found a myriad of posts which explain how to join a certificate and the corresponding private key into a file in PFX format, but this is not what I'm after.
Actually, I need to import that certificate into the Windows certificate store. But I'd still like to generate the certificate / key using Linux / OpenSSL.
I first tried to generate the certificate in PEM format and just appended the private key file (also in PEM format) to it. Windows certificate management could import that file, but lost the private key (it correctly shows the certificate, but claims that I don't have a private key for it).
Next I took the certificate and the private key and joined them into a PFX file. The problem with that is that OpenSSL is not able to generate a PFX file without an export password for the private key. Windows certificate management can import that PFX file (including the private key), but the service which should use the certificate refuses using it with obscure error messages. I have put two days into debugging, but to no avail. Perhaps the export password is the problem (although the Windows certificate subsystem hopefully doesn't ask for it once the certificate has been imported).
So my last hope is to generate a DER file containing the certificate along with the private key. I know that it is possible to put a certificate and a private key into a DER file because I can create such files using Windows tools. But how do I do that under Linux / OpenSSL?
I am using something like the following script to generate the same certificate in various formats (this is the current version, already tried countless variations):
#!/bin/bash # Generate RSA key openssl genrsa -out key.pem 4096 # Generate certificate request openssl req -new -nodes -key key.pem -out csr.pem -subj /CN=DAX # Generate self-signed certificate (sign the certificate request) openssl req -x509 -nodes -sha256 -days 36500 -key key.pem -in csr.pem -out cert.pem # Add some extensions ... openssl x509 -extfile /etc/ssl/pp-openssl.cnf -sha256 -days 36500 -signkey key.pem -in cert.pem -out ext.pem # Append private key to the PEM certificate cat key.pem >> ext.pem # Create PFX and DER formats openssl pkcs12 -nodes -export -out cert.pfx -inkey key.pem -in ext.pem openssl x509 -outform der -out cert.cer -in ext.pem
The last line obviously strips the private key (does not include it into the DER file), although it is included in the PEM input file.
I know that it is possible to put a certificate and a private key into a DER file because I can create such files using Windows tools.
It turned out that this statement which I have made above is wrong. I have misinterpreted my test results - see my comments below. In short, it is not possible to have a certificate and a private key in the same DER file.
However, I am leaving the original question as-is for future reference.