Search code examples
opensslder

Combine DER formated certificate and key into one file

With PEM simple cat works fine:

cat key.pem cert.pem >cert+key.pem

And extration works fine

openssl pkey -text -noout -in cert+key.pem  # OK
openssl x509 -text -noout -in cert+key.pem  # OK

But with DER this does not work.

cat cert.der key.der >cert+key.der
openssl x509 -text -noout -in cert+key.der -inform der  # OK
openssl pkey -text -noout -in cert+key.der -inform der  # ERROR

Can't open RBBR11912AZ000035.der for reading, No such file or directory
4612937152:error:02001002:system library:fopen:No such file or directory:crypto/bio/bss_file.c:69:fopen('RBBR11912AZ000035.der','rb')
4612937152:error:2006D080:BIO routines:BIO_new_file:no such file:crypto/bio/bss_file.c:76:
unable to load key

The order makes sense. OpenSSL can parse only first key or cert.

How to properly concatenate cert + key in DER format?

Solution

  • The DER is a encoding for a single certificate. Just like a BMP file is a format for a single bitmap image. So it doesn't support multiple certificates in one file.

    You can think of PEM file as a "container" format. It contains one or more base64 DER formatted certificates (along with other things like private keys).

    Another certificate container format is PKCS12 (.pfx) which can be thought of like a binary version of the PEM format.