Useful OpenSSL commands

1. How to setup a CA and sign a user certificate: http://pages.cs.wisc.edu/~zmiller/ca-howto/
   Commands used:
   a. create a key pair
       openssl genrsa -des3 -out root-ca.key 1024
   b. use the key to sign itself: (this will create a self-signed CA)
       openssl req -new -x509 -days 3650 -key root-ca.key -out root-ca.crt -config openssl.cnf
   c. take a look at the certificate we just created
       openssl x509 -noout -text -in root-ca.crt
   d. create a user certificate request
      openssl req -newkey rsa:1024 -keyout ehuang.key -config openssl.cnf -out xxx.req
   d1. print a request
      openssl req -text -in xxx.req
   e. sign the certificate
      openssl ca -config openssl.cnf -out xxx.crt -infiles xxx.req
   f. create a pkcs8 format key
      openssl pkcs8 -topk8 -outform DER -in xxx.key -inform PEM -out xxx.key.pk8 -nocrypt

2. How to sign an Android APK: http://stackoverflow.com/questions/12566939/android-apk-sign-information

   a. remove old signature from apk
      for f in `aapt list HelloActivity.apk |grep "META-INF"` ; do
          aapt remove HelloActivity.apk $f
      done
   b. sign the apk
    java -jar signapk.jar xxx.crt xxx.key.pk8 HelloActivity.apk HelloActivity-signed.apk
3. How to get signapk.jar
   a. go to platform root folder
   b. . build/envsetup.sh; lunch <option>
   c. go to build/tools/signapk
   d. mm -B
#openssl req -newkey rsa:1024 -keyout xxx.debug.key -config openssl.cnf -out xxx.debug.req
#openssl ca -config openssl.cnf -out xxx.debug.crt -infiles xxx.debug.req
#openssl x509 -in xxx.debug.crt -text
#openssl pkcs8 -topk8 -outform DER -in xxx.debug.key -inform PEM -out xxx.debug.key.pk8 -nocrypt
4. Verify signature
   a. show the conent of signature block
      openssl asn1parse -i -inform DER -in CERT.RSA
   b. Verify the signature with certificate
      openssl smime -verify -in CERT.RSA -inform DER -content CERT.SF signing-cert.pem

5. Import a certificate to android
   a. get the hash of the cerificate
     openssl x509 -inform PEM -subject_hash_old -in signing-ca-1.crt | head -1
   b. generate the file to be stored in Android
     openssl x509 -inform PEM -text -in signing-ca-1.crt >> 019f6ef1.0
   c. one step:
     openssl x509 -inform PEM -text -in signing-ca-1.crt >> `openssl x509 -inform PEM -subject_hash_old -in signing-ca-1.crt | head -1`.0


Multiple-level CAs
1.Create root key:
  openssl genrsa -des3 -out root-ca.key 1024
2. Use the root key to sign itself:
   openssl req -new -x509 -days 3650 -key root-ca.key -out root-ca.crt -config openssl.cnf
3. perl mk_new_ca_dir.pl
   mv root-ca.crt RootCA
   mv root-ca.key RootCA
4. Create singing certificate
   openssl genrsa -des3 -out signing-ca-1.key 1024
   openssl req -new -days 1095 -key signing-ca-1.key -out signing-ca-1.csr -config openssl.cnf
   openssl ca -config openssl.cnf -name CA_root -extensions v3_ca -out signing-ca-1.crt -infiles signing-ca-1.csr
   perl mk_new_ca_dir.pl SigningCA1
   mv signing-ca-1.crt SigningCA1
   mv signing-ca-1.key SigningCA1
5. Create user key
   openssl req -newkey rsa:1024 -keyout zmiller.key -config openssl.cnf -out zmiller.req
   openssl ca -config openssl.cnf -out zmiller.crt -infiles zmiller.req
6. To get a hash:
       openssl x509 -noout -hash -in host.crt
   To get a subject:
       openssl x509 -noout -subject -in host.crt
   To see the whole cert:
       openssl x509 -noout -text -in host.crt

Transfter openssl certificate in pkcs 12 format:
openssl pkcs12 -export -in server.crt -inkey server.key > server.p12
Import to a java keystore:
keytool -importkeystore -srckeystore server.p12 -destkeystore server.jks -srcstoretype pkcs12

Change a key to password-less.
openssl rsa -in signing-ca-1.key -out server.key
keytool -delete -alias 1 -keystore server.jks

Start a ocsp server:
openssl ocsp -index index.txt -port 8888 -rsigner ocsp.crt -rkey ocsp_nopw.key -CA signing-ca-1.crt -text -out log.txt

openssl ocsp -index index.txt -port 8888 -rsigner ocsp.crt -rkey ocsp_nopw.key -CA signing-ca-1.crt -text -out log.txt
Issue a ocsp request:
openssl ocsp -issuer ec_ocsp.pem -cert xxx.pem -host 127.0.0.1:8888 -resp_text -respout resp.der -VAfile ocsp.pem

Verify ocsp stapling:
openssl s_client -connect 127.0.0.1:9443 -tls1 -tlsextdebug -status -CApath /etc/ssl/certs/

//show text format of a x509 key
X509_print(arg, sk_X509_value(server_chain,i));
//Wriate a x509 certificate to a file
PEM_write_bio_X509(arg,sk_X509_value(server_chain,i));

//create a ecdsa key
openssl ecparam -name secp224r1 -genkey -out ecdsa224.key
//create a csr
openssl req -sha1 -days 3650 -new -key ecdsa224.key -out ecdsa224.req
//sign the request
openssl ca -in ecdsa224.req -out ecdsa224.pem
//Revoke a certificate
openssl ca -revoke client_cert.pem
//generate CRL
openssl ca -gencrl -out exampleca.crl