I would like to extract the public part of a revoked P12 which doesn't belong to me. I can't open it with KeyStore Explorer because I am prompted for the password, is it possible with OpenSSL ?
The password only protects the private key(s), not the certificate, am i right ?
It can be done with openssl. In a terminal type:
openssl pkcs12 -in myfile.p12 -nokeys -nomacver
And just press ENTER when the import key is requested. The certificates contained in the PKCS12 file should be printed (en PEM format) on the standard output.
NOTE: even if the certificates are present in plain text in the PCKS12 file, the file full content integrity is protected by a Message Authentication Code (MAC). Without the password you are not able to verify that the file has not been modified and it means that anyone who could access the file would be able the add, remove or modify the certificates. It may be a security concern, not necessary in your case, but you should keep that in mind if you want to reuse that tip in other circumstances.
You can use openssl or keytool command to extract the public key from a p12 file, but the integrity will not be verified.
Yes You are right, the password is protecting the private key.
First question here is that already the key got revoked , why do you want to use it the revoked one again. Is there is a intentional reason to work on it ?
You can open the public part by using the keytool command.The command follows here
keytool -list -keystore -storetype pkcs12 -rfc
It will prompt for a password and just press enter button will do the job.
the Java keystore contains certificate information
To be more precise it contains public keys or key pairs (public and private key). The keystore is protected by a password and every private key is also protected by a password. However you are able to change or remove passwords. It's up to you. A Java keystore is like a detached keystore of a web browser i.e.
Mozilla -> Edit -> Preferences -> Advanced -> Certificates, Chrome -> Settings -> Advanced Settings -> HTTPS/SSL
A Certificate Manager of such manages your certificates, peoples public keys, server or Certificate Authority certificates which are also public keys. They are stored in the keystore of a browser.
but this information is public (i.e. other machine certificates which you want the local machine to trust)
Public are only keys that don't need any protection, they are the public keys. Private keys are not public and protected by a password.
You decide when to use the keys and when stolen it is not easy extract informations from. So a keystore is a security enchancement.
But you speak generally about the level of trust, or Trust metrics.
To do this you need to know, that a private keys can theoretically also be guessed, so your security is not 100%. A todays supercomputer listed at Top500 Supercomputer Sites with 33,862.7 Tera Flops/s could bruteforce you private key. Theoretically, your computer/laptop can be stolen or your keystore can be stolen and your passwords can be read by a trojan.
You will end up asking, how high is the risk if my keystore would be stolen and decrypted and what can I do to prevent it. This is often also a question of effort and price.
If your risk is high, then you need to store your keystore on a detached disk (i.e. pen drive), use long complex passwords and use a special protected machine to connect from.
4 down vote
If you are talking about the truststore, the risk isn't that someone will see or steal the certs in the truststore. The risk is that someone will add a certificate into the store which you do not want to trust. The store should be protected first protected by the OS permissions. The password is an additional protection.