Search code examples
encryptionopensslenvironment-variablesx509pfx

Verifying the password of generated x509 certificate

I have created a x509 certificate. There is a set of openssl commands I used to create it, for example the first command it:

openssl genrsa -passout pass:"$MYPWD" -out privkey.key 2048

where "$MYPWD" is an environment variable where I set the password. After executing this command, how would I check that the password is actually the value of MYPWD environment variable, and not just literally "$MYPWD"?

Thank you everyone in advance!

Solution

  • You must specify a cypher to encrypt the output.

    openssl genrsa -aes256 -passout env:MYPWD -out privkey.key 2048

    To verify that the password was actually set, simply read back the key:

    openssl pkey -in privkey.key

    You will see the password prompt.

    You can also inspect the content of the privkey.key, "ENCRYPTED"... will be there.

    cat privkey.key

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-256-CBC,3A2E02985A117F7266F9664420F685B2

...