Handling Certificates: Private Keys, CSRs, Certificates, PFX/PKCS12 Format

A common issue when integrating components accross the boundaries of an organization (or sometimes even within) is the utilization of certificates for improving the security of the machine-to-machine communication. More specifically, certificates and cryptography can be used to mitigate man-in-the-middle risks as well as provide a framework for authentication (client-side certificates). In this post, I will use OpenSSL, which is an open source tool, to demonstrate how:

1. to create a private key
2. to create and sign a CSR (Certificate Signing Request)
3. to bundle certificates and private key in PFX/PKCS12 files

The above steps are typically applied when client authentication is performed with a client-side certificate. In a nutshell, the service consumer needs to provide a CSR signed with her private key (either independently created (1), or created along the CSR creation (3)). Then the consumer sends the CSR to the provider who typically serves as a CA and creates a certificate for the provided CSR (typically a .crt file). The certificate file is returned to the consumer and it is usually bundled with the private key (and probably other certificates in its certificate chain) in a PFX/PKCS12 file (3), so that application servers and runtimes can use them. (In a subsequent post I plan to demonstrate how such certificates can be installed to a Windows machine in order to be used by browsers or custom applications.)
So if you are the service consumer of a similar situation keep reading.

First of all, a copy of OpenSSL needs to be downloaded and installed. For Linux users, OpenSSL is typically installed but if not you can easily download and install it from OpenSSL.org. For Windows users, you can download from here, selecting one of the available choices. Then, you may want to add the path of openssl.exe to your %PATH%. Finally, you can start using it though the command prompt.

1. Creating a Private Key

openssl genrsa -out private.key 2048

2. Creating and Signing a CSR

openssl req -new -sha256 -key private.key -out mycsr.csr

3. Bundling Certificates and Private Key into a PFX/PKCS12 file

openssl pkcs12 -export -out certs.pfx -inkey private.key -in mycert.crt -certfile CA.crt