97

I already have purchased SSL certificate and i have received certificate and a .pem file as a private key? from the supplier; now i need to convert this .pem key into .key for bitnami Redmine Apache web server in order to make it work.

How do I go about doing this what what program or commands to do this? I am a newbie in terms of using Openssl etc to do this.

Any advice would be much appreciated!

Thank you.

2

6 Answers 6

107

I assume you want the DER encoded version of your PEM private key.

openssl rsa -outform der -in private.pem -out private.key
1
  • 4
    @siddharth this post was about conversion of a private key. If you want to convert a certificate use: "openssl x509 -outform der -in cert.pem -out cert.der"
    – Camille G.
    Jul 17, 2019 at 10:53
54

openssl rsa -in privkey.pem -out private.key does the job.

1
  • This worked for me on a .pem generated from Openstack keypair
    – deepdive
    Feb 13, 2019 at 5:27
29
openssl x509 -outform der -in your-cert.pem -out your-cert.crt
2
  • both certificates and keys are required
    – F.O.O
    Aug 15, 2016 at 22:07
  • 3
    Your command only gives crt file
    – Prateek
    Feb 17, 2022 at 7:22
9

CA's don't ask for your private keys! They only asks for CSR to issue a certificate for you.

If they have your private key, it's possible that your SSL certificate will be compromised and end up being revoked.

Your .key file is generated during CSR generation and, most probably, it's somewhere on your PC where you generated the CSR.

That's why private key is called "Private" - because nobody can have that file except you.

3
  • Thanks for reply. My CSR was done on the supplier's website & it was auto-generated prior to purchase. so from supplier i received intermediateCA, .pem & certificate itself, files itself was copied from my email received, saved with the extensions of certificate.crt, intermediateca.crt & i am trying to convert .pem into .key, as i have tried the .pe, file itself,no sucess i got"RSA Certificate configured for localhost:443 does NOT include an ID which matches the server name".Trying to solve this checked all servername are correct throughout the httpd.conf & ssl-httpd.conf. please advise.thnks Nov 19, 2013 at 9:41
  • Most probably your supplier can provide you the key for it. If you can find -Begin Private key- somewhere on your codes that was provided then that is your private key. Just save it on a notepad and save it as .key. Nov 20, 2013 at 1:37
  • Thank you The Whisperer, I already have done that and double checked the correct paths and restarted services still dont work. Nov 20, 2013 at 15:47
3

If you're looking for a file to use in httpd-ssl.conf as a value for SSLCertificateKeyFile, a PEM file should work just fine.

See this SO question/answer for more details on the SSL options in that file.

Why is SSLCertificateKeyFile needed for Apache?

0

just as a .crt file is in .pem format, a .key file is also stored in .pem format. Assuming that the cert is the only thing in the .crt file (there may be root certs in there), you can just change the name to .pem. The same goes for a .key file. Which means of course that you can rename the .pem file to .key.

Which makes gtrig's answer the correct one. I just thought I'd explain why.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.