Knowledge Base

openssl x509 < rapidssl.crt -out rapidssl.pem

openssl pkcs12 -export -in wildcard-2016.crt -inkey wildcard-2016.key -out wildcard-2016.p12 -name wildcard -CAfile rapidssl-2016.crt -caname root
openssl pkcs12 -in wildcard-2016.p12 -out wildcard-2016.pem -nodes –clcerts
openssl x509 -in rapidssl-2016.crt -out rapidssl-2016.pem
cat wildcard-2016.pem rapidssl-2016.pem > wildcardchain-2016.pem
openssl pkcs12 -export -in wildcardchain-2016.pem -out wildcardchain-2016.pfx

openssl pkcs7 -print_certs -in crx.p7b | openssl pkcs12 -export -inkey crx.key -out crx.pfx -certfile crx.crt

URI ldaps://example.com
BASE dc=example,dc=com
TLS_CACERTDIR /etc/openldap/cacerts

4669ff29.0 -> authconfig.pem
authconfig.pem (the examplemicrosoft certs catted)
examplemicrosoftintermeidateca.crt
examplemicrosoftrootca.crt
examplenovellca.crt

cd /etc/openldap/cacerts
ln -sf certs-example-2016.pem "$( openssl x509 -in certs-example-2016.pem -hash -noout ).0"

openssl genrsa -aes256 -out wwwexamplecom-2016.key 2048
openssl req -new -key wwwexamplecom-2016.key -out wwwexamplecom-2016.csr
Enter pass phrase for wwwexamplecom-2016.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]: **US**
State or Province Name (full name) []: **Anystate**
Locality Name (eg, city) [Default City]: **Anytown**
Organization Name (eg, company) [Default Company Ltd]: **Example Company**
Organizational Unit Name (eg, section) []: **IT**
Common Name (eg, your name or your server's hostname) []: **www.example.com**
Email Address []: **linuxadmin@example.com**
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Send the csr to someone. This uses the send.sh script from bgscripts package.
send.sh -hs "csr for www.example.com" wwwexamplecom-2016.csr usertwo@example.com

openssl rsa -in old.key -out new.key

cp ca2.example.com.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust

openssl req -newkey rsa:2048 -nodes -keyout cert.key -x509 -days 365 -out cert.pem

/usr/lib/jvm/java/jre/bin/keytool -import -trustcacerts -alias "myaliasname" -storetype jks -keystore /usr/lib/jvm/java/jre/lib/security/cacerts -file ./comodo.cer -storepass changeit

printf '\n' | openssl s_client -connect ipa.example.com:443

openssl x509 -inform der -in certificate.cer -out certificate.pem

openssl pkcs12 -in cert.pfx -passin pass:'' -nodes -clcerts | openssl x509 -noout -subject -issuer -startdate -enddate

certchain="$( mktemp )" ; echo '' | openssl s_client -showcerts -connect pypi.python.org:443 > ${certchain} ; certcount=$( grep -cE '^-----BEGIN CERT' ${certchain} 2>/dev/null ); cat ${certchain} | { x=0 ; while test $x -lt ${certcount} ; do openssl x509 -noout -subject -issuer -dates ; x=$(( x + 1 )) ; done ; }

# near the top:
oid_section = new_oids
# anywhere else
[ new_oids ]
certificateTemplateName = 1.3.6.1.4.1.311.20.2

[ req ]
req_extensions = req_ext

[ req_ext ]
certificateTemplateName = ASN1:PRINABLESTRING:ApplicationUser
You need to choose the template name and not the template display name.

certreq -submit -config "<hostname.fqdn>\<CA Name Here>" -attrib "CertificateTemplate:<Template Name>" "C:\temp\csr.txt" "C:\temp\output.cer"

certutil -A -i /mnt/public/www/example/certs/ca-ipa.example.com.crt -n 'ipa.example.com root' -t "TCu,Cuw,Tuw" -d ~/.pki/nssdb/