|
| 1 | +Taken from : https://www.scottbrady91.com/OpenSSL/Creating-Elliptical-Curve-Keys-using-OpenSSL |
| 2 | + |
| 3 | +Recently, I have been using OpenSSL to generate private keys and X509 certificates |
| 4 | +for Elliptical Curve Cryptography (ECC) and then using them in ASP.NET Core for token signing. |
| 5 | + |
| 6 | +In this article, I�m going to show you how to use OpenSSL to generate private and public |
| 7 | +keys on the curve of your choice. Check out my other article for how to do the same for RSA |
| 8 | +keys. |
| 9 | + |
| 10 | +OpenSSL ECDSA Cheat Sheet |
| 11 | +------------------------------------------------------------------- |
| 12 | +# find your curve |
| 13 | +openssl ecparam -list_curves |
| 14 | + |
| 15 | +# generate a private key for a curve |
| 16 | +openssl ecparam -name prime256v1 -genkey -noout -out private-key.pem |
| 17 | + |
| 18 | +# generate corresponding public key |
| 19 | +openssl ec -in private-key.pem -pubout -out public-key.pem |
| 20 | + |
| 21 | +# optional: create a self-signed certificate |
| 22 | +openssl req -new -x509 -key private-key.pem -out cert.pem -days 360 |
| 23 | + |
| 24 | +# optional: convert pem to pfx |
| 25 | +openssl pkcs12 -export -inkey private-key.pem -in cert.pem -out cert.pfx |
| 26 | +Generating an Elliptical Curve Private Key Using OpenSSL |
| 27 | +To start, you will need to choose the curve you will be working with. You can use the |
| 28 | +following command to see a list of |
| 29 | +supported curve names and descriptions. |
| 30 | + |
| 31 | +openssl ecparam -list_curves |
| 32 | +In this example, I am using prime256v1 (secp256r1), which is suitable for JWT signing; |
| 33 | +this is the curve used for JOSE�s ES256. |
| 34 | +------------------------------------------------------------------- |
| 35 | + |
| 36 | +You can now generate a private key: |
| 37 | + |
| 38 | +openssl ecparam -name prime256v1 -genkey -noout -out private-key.pem |
| 39 | +This should give you a PEM file containing your EC private key, which looks something |
| 40 | +like the following: |
| 41 | + |
| 42 | +-----BEGIN EC PRIVATE KEY----- |
| 43 | +MHcCAQEEIKEubpBiHkZQYlORbCy8gGTz8tzrWsjBJA6GfFCrQ98coAoGCCqGSM49 |
| 44 | +AwEHoUQDQgAEOr6rMmRRNKuZuwws/hWwFTM6ECEEaJGGARCJUO4UfoURl8b4JThG |
| 45 | +t8VDFKeR2i+ZxE+xh/wTBaJ/zvtSqZiNnQ== |
| 46 | +-----END EC PRIVATE KEY----- |
| 47 | + |
| 48 | +Creating an EC Public Key from a Private Key Using OpenSSL |
| 49 | +Now that you have your private key, you can use it to generate another PEM, containing |
| 50 | +only your public key. |
| 51 | + |
| 52 | +openssl ec -in private-key.pem -pubout -out public-key.pem |
| 53 | +This should give you another PEM file, containing the public key: |
| 54 | + |
| 55 | +-----BEGIN PUBLIC KEY----- |
| 56 | +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOr6rMmRRNKuZuwws/hWwFTM6ECEE |
| 57 | +aJGGARCJUO4UfoURl8b4JThGt8VDFKeR2i+ZxE+xh/wTBaJ/zvtSqZiNnQ== |
| 58 | +-----END PUBLIC KEY----- |
| 59 | + |
| 60 | +Creating an EC Self-Signed Certificate Using OpenSSL |
| 61 | +Now that you have a private key, you could use it to generate a self-signed certificate. |
| 62 | +This is not required, but it allows you to use the key |
| 63 | +for server/client authentication, or gain X509 specific functionality in technologies |
| 64 | +such as JWT and SAML. |
| 65 | + |
| 66 | +openssl req -new -x509 -key private-key.pem -out cert.pem -days 360 |
| 67 | +This will again generate another PEM file, this time containing the certificate created |
| 68 | +by your private key: |
| 69 | + |
| 70 | +-----BEGIN CERTIFICATE----- |
| 71 | +MIIB4DCCAYWgAwIBAgIUH53ssiPt4JEGx+VJyntCpHL+TdAwCgYIKoZIzj0EAwIw |
| 72 | +RTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGElu |
| 73 | +dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMDA3MTgxMTE4NDNaFw0yMTA3MTMx |
| 74 | +MTE4NDNaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYD |
| 75 | +VQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjO |
| 76 | +PQMBBwNCAAQ6vqsyZFE0q5m7DCz+FbAVMzoQIQRokYYBEIlQ7hR+hRGXxvglOEa3 |
| 77 | +xUMUp5HaL5nET7GH/BMFon/O+1KpmI2do1MwUTAdBgNVHQ4EFgQU9yjFBqAZOMv+ |
| 78 | +cD6a3KHTWuYrcFEwHwYDVR0jBBgwFoAU9yjFBqAZOMv+cD6a3KHTWuYrcFEwDwYD |
| 79 | +VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNJADBGAiEAwCpA5Nx083qqUqU6LUd0 |
| 80 | +vzZLK4etuInxNvXohXH5LiACIQDSI63J4DiN3dq2sPPLw5iQi9MMefcV1iAySbKT |
| 81 | +B9BaAw== |
| 82 | +-----END CERTIFICATE----- |
| 83 | + |
| 84 | +You could leave things there, but if you are working on Windows, you may prefer a PFX |
| 85 | +file that contains both the certificate and the private key for you to export and use. |
| 86 | + |
| 87 | +You can do this using OpenSSL�s pkcs12 command: |
| 88 | + |
| 89 | +openssl pkcs12 -export -inkey private-key.pem -in cert.pem -out cert.pfx |
| 90 | +OpenSSL will ask you to create a password for the PFX file. Feel free to leave this blank. |
| 91 | + |
| 92 | +This should leave you with a certificate that Windows can both install and export the |
| 93 | +EC private key from. |
0 commit comments