Rafael Pfister

Certificates / PKI

Create a CSR, inspect a PFX, convert formats, check expiry in the store.

Create a CSR

Creates a certificate request and key, with all additional names (SAN) for mail and Autodiscover hosts.

Mail + Autodiscover

PowerShell (Windows)

certreq Built-in 

@"
[NewRequest]
Subject = "CN=mail.example.com"
KeyLength = 2048
Exportable = TRUE
MachineKeySet = TRUE
[Extensions]
2.5.29.17 = "{text}dns=mail.example.com&dns=autodiscover.example.com"
"@ | Set-Content req.inf
certreq -new req.inf mail.example.com.csr

openssl Add-on tool 

openssl req -new -newkey rsa:2048 -nodes -keyout privkey.pem -out mail.example.com.csr -subj "/CN=mail.example.com" -addext "subjectAltName=DNS:mail.example.com,DNS:autodiscover.example.com"

Unix shell (bash)

openssl Built-in 

openssl req -new -newkey rsa:2048 -nodes -keyout privkey.pem -out mail.example.com.csr -subj "/CN=mail.example.com" -addext "subjectAltName=DNS:mail.example.com,DNS:autodiscover.example.com"

certtool Add-on tool 

certtool --generate-privkey --outfile privkey.pem && certtool --generate-request --load-privkey privkey.pem --outfile mail.example.com.csr

Modern browsers and servers evaluate the SAN entries only; the common name alone has not been enough for years. certreq stores the key in the Windows certificate store, openssl in a file.

Inspect a CSR

Shows the content of a certificate request before it goes to the CA: names, key length and signature.

PowerShell (Windows)

certutil Built-in 

certutil -dump mail.example.com.csr

openssl Add-on tool 

openssl req -in mail.example.com.csr -noout -text -verify

Unix shell (bash)

openssl Built-in 

openssl req -in mail.example.com.csr -noout -subject -reqopt no_sigdump -text | head -20

certtool Add-on tool 

certtool --crq-info --infile mail.example.com.csr

Inspect a PFX file

Shows subject, issuer, validity and chain of a PFX/P12 file and whether the private key is included.

PowerShell (Windows)

Get-PfxData Built-in 

$pw = Read-Host "PFX-Passwort" -AsSecureString
$d = Get-PfxData -FilePath "cert.pfx" -Password $pw
$d.EndEntityCertificates | Format-List Subject, Issuer, NotAfter, Thumbprint, HasPrivateKey
$d.OtherCertificates | ForEach-Object { $_.Subject }

openssl Add-on tool 

openssl pkcs12 -in cert.pfx -nokeys -info | openssl x509 -noout -subject -issuer -dates

Unix shell (bash)

openssl Built-in 

openssl pkcs12 -in cert.pfx -nokeys -legacy 2>/dev/null | openssl x509 -noout -subject -issuer -dates

certtool Add-on tool 

certtool --p12-info --infile cert.pfx

For older PFX files, OpenSSL 3 needs the -legacy switch, otherwise it rejects the old RC2 algorithm.

Convert formats

Converts between PFX/P12 and PEM (certificate and key separately): the most common step when moving a certificate between Windows and an appliance.

PowerShell (Windows)

certutil / Export-PfxCertificate Built-in 

# PFX -> Base64-PEM (nur Zertifikat, ohne Schlüssel)
certutil -encode cert.pem.der cert.pem
# Zertifikat aus dem Store als PFX exportieren:
# Get-ChildItem Cert:\LocalMachine\My\<Thumbprint> | Export-PfxCertificate -FilePath cert.pfx -Password (Read-Host -AsSecureString)

openssl Add-on tool 

openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.pem
openssl pkcs12 -in cert.pfx -nocerts -nodes -out privkey.pem

Unix shell (bash)

openssl Built-in 

openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.pem
openssl pkcs12 -in cert.pfx -nocerts -nodes -out privkey.pem
openssl pkcs12 -export -in cert.pem -inkey privkey.pem -out neu.pfx

certtool Add-on tool 

certtool --load-certificate cert.pem --load-privkey privkey.pem --to-p12 --outfile neu.p12

The key file produced is unencrypted. Delete it after importing and do not leave it on a network share.

Do key and certificate match?

Checks whether a key file belongs to the certificate: an identical checksum means they belong together.

PowerShell (Windows)

X509Certificate2 Built-in 

$c = New-Object Security.Cryptography.X509Certificates.X509Certificate2 "cert.pem"
"HasPrivateKey: $($c.HasPrivateKey)"
$c.PublicKey.Key.ToXmlString($false).Substring(0, 60)

openssl Add-on tool 

openssl x509 -in cert.pem -noout -modulus | openssl md5
openssl rsa -in privkey.pem -noout -modulus | openssl md5

Unix shell (bash)

openssl Built-in 

openssl x509 -in cert.pem -noout -modulus | openssl sha256
openssl rsa -in privkey.pem -noout -modulus | openssl sha256
# Gleiche Prüfsumme = Schlüssel und Zertifikat gehören zusammen.

certtool Add-on tool 

certtool --certificate-info --infile cert.pem | grep -A2 "Public Key ID"

This mix-up is the most common cause of "the certificate cannot be imported".

Inspect the certificate store

Lists the installed certificates with thumbprint, subject and expiry.

PowerShell (Windows)

Cert: PSDrive Built-in 

Get-ChildItem Cert:\LocalMachine\My | Sort-Object NotAfter |
  Format-Table Thumbprint, Subject, NotAfter, HasPrivateKey -AutoSize
Get-Item Cert:\LocalMachine\My\A1B2C3D4E5F6A7B8C9D0E1F2A3B4C5D6E7F8A9B0 | Format-List *

certutil Built-in 

certutil -store My

Unix shell (bash)

ls / openssl Built-in 

ls -1 /etc/ssl/certs | head -20
awk -v cmd='openssl x509 -noout -subject -enddate' '/BEGIN/{close(cmd)};{print | cmd}' /etc/ssl/certs/ca-certificates.crt | head -20

trust Add-on tool 

trust list --filter=ca-anchors | head -40

On Windows the thumbprint is the identifier Exchange and IIS use to bind a certificate.

What expires soon?

Finds certificates expiring within the next 60 days: the check that prevents a weekend outage.

PowerShell (Windows)

Cert: PSDrive Built-in 

Get-ChildItem Cert:\LocalMachine\My |
  Where-Object { $_.NotAfter -lt (Get-Date).AddDays(60) } |
  Sort-Object NotAfter |
  Format-Table Subject, NotAfter, Thumbprint -AutoSize

certutil Add-on tool 

certutil -store My | findstr /C:"NotAfter"

Unix shell (bash)

openssl Built-in 

for c in /etc/ssl/certs/*.pem; do
  openssl x509 -in "$c" -noout -checkend 5184000 >/dev/null 2>&1 || echo "laeuft bald ab: $c"
done

certtool Add-on tool 

certtool --certificate-info --infile /etc/ssl/certs/ssl-cert-snakeoil.pem | grep -E "Not After"

Other areas