9

I am trying to generate a key from a CRT file.

I have installed OpenSSL on Windows and tried to get a random key using

enter image description here

I have the CRT file but I'm unsure how to get keys from it. Inside the CRT file it shows -----BEGIN CERTIFICATE-----.

1 Answer 1

18

In the image, note the OpenSSL> prompt. It means you're inside openssl command and you don't need to type "openssl" again (that's why you've got the message "openssl is an invalid command"). In this case, you should just type genrsa etc...

But I don't know if I get what you're trying to do (generate a key from a crt file), mainly because: genrsa is a command to generate a new key pair using RSA algorithm. In short, it generates 2 keys: one private and one public. The public key will be signed by a Certification Authority, and the result is a digital certificate (which can be in a CRT file)

My point is: if you have a CRT file (aka certificate), it means a key pair was already generated and signed by a Certification Authority. There's no way to generate a new key from it (because it already has a key).

If you want to get the public key that's inside the certificate, you must read it using openssl x509 command. Something like:

openssl x509 -text -in crtfile` (or omit "openssl" if you're inside `OpenSSL>` prompt).

PS: this command prints the whole certificate. If you want just the public key, you can run:

openssl x509 -pubkey -noout -in crtfile

If you want to generate a new key pair, then use genrsa.

3
  • thanks for your help with this, inside OpenSSL prompt how can I find my C:// directory so I can use x509 -text -in crtfile?
    – Sam
    Commented Mar 14, 2017 at 14:28
  • You can replace "crtfile" with the full path of the file, I think
    – user7605325
    Commented Mar 14, 2017 at 14:29
  • @Samantha, I edited the answer adding an option to get just the public key from the certificate (if that's what you need)
    – user7605325
    Commented Mar 14, 2017 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.