IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [pem]

Privacy Enhanced Mail (PEM) is a scheme for encoding cryptographic data into ASCII as used by PGP clients. Alternate usage: `.pem` files are a container format for storing certificates, private keys, and CSRs.

The original purpose of PEM, as proposed in 1993 in RFCs 1421, and 1424 was as a method of securing email messages. In this sense, it is a competing standard with S/MIME, invented much later in 2002 - 2004 (RFCs 3369, 3370, 3850 and 3851). PEM continues to be used for its original purpose by PGP clients.

Since PEM provides a method for encoding crytographic information into ASCII, PEM has found an alternate usage in .pem files which act as a container format for certificate data; including public certificates, private keys, and certificate signing requests (CSRs).

A typical PEM-encoded certificate looks like this (source: wikipedia):

-----BEGIN CERTIFICATE-----
MIIEczCCA1ugAwIBAgIBADANBgkqhkiG9w0BAQQFAD..AkGA1UEBhMCR0Ix
EzARBgNVBAgTClNvbWUtU3RhdGUxFDASBgNVBAoTC0..0EgTHRkMTcwNQYD
VQQLEy5DbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcn..XRpb24gQXV0aG9y
aXR5MRQwEgYDVQQDEwtCZXN0IENBIEx0ZDAeFw0wMD..TUwMTZaFw0wMTAy
MDQxOTUwMTZaMIGHMQswCQYDVQQGEwJHQjETMBEGA1..29tZS1TdGF0ZTEU
MBIGA1UEChMLQmVzdCBDQSBMdGQxNzA1BgNVBAsTLk..DEgUHVibGljIFBy
aW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFD..AMTC0Jlc3QgQ0Eg
THRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCg..Tz2mr7SZiAMfQyu
vBjM9OiJjRazXBZ1BjP5CE/Wm/Rr500PRK+Lh9x5eJ../ANBE0sTK0ZsDGM
ak2m1g7oruI3dY3VHqIxFTz0Ta1d+NAjwnLe4nOb7/..k05ShhBrJGBKKxb
8n104o/5p8HAsZPdzbFMIyNjJzBM2o5y5A13wiLitE..fyYkQzaxCw0Awzl
kVHiIyCuaF4wj571pSzkv6sv+4IDMbT/XpCo8L6wTa..sh+etLD6FtTjYbb
rvZ8RQM1tlKdoMHg2qxraAV++HNBYmNWs0duEdjUbJ..XI9TtnS4o1Ckj7P
OfljiQIDAQABo4HnMIHkMB0GA1UdDgQWBBQ8urMCRL..5AkIp9NJHJw5TCB
tAYDVR0jBIGsMIGpgBQ8urMCRLYYMHUKU5AkIp9NJH..aSBijCBhzELMAkG
A1UEBhMCR0IxEzARBgNVBAgTClNvbWUtU3RhdGUxFD..AoTC0Jlc3QgQ0Eg
THRkMTcwNQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcm..ENlcnRpZmljYXRp
b24gQXV0aG9yaXR5MRQwEgYDVQQDEwtCZXN0IENBIE..DAMBgNVHRMEBTAD
AQH/MA0GCSqGSIb3DQEBBAUAA4IBAQC1uYBcsSncwA..DCsQer772C2ucpX
xQUE/C0pWWm6gDkwd5D0DSMDJRqV/weoZ4wC6B73f5..bLhGYHaXJeSD6Kr
XcoOwLdSaGmJYslLKZB3ZIDEp0wYTGhgteb6JFiTtn..sf2xdrYfPCiIB7g
BMAV7Gzdc4VspS6ljrAhbiiawdBiQlQmsBeFz9JkF4..b3l8BoGN+qMa56Y
It8una2gY4l2O//on88r5IWJlm1L0oA8e4fR2yrBHX..adsGeFKkyNrwGi/
7vQMfXdGsRrXNGRGnX+vWDZ3/zWI0joDtCkNnqEpVn..HoX
-----END CERTIFICATE-----
34 questions
26
votes
2 answers

Generate CSR and private key with password with OpenSSL

I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj "/CN=sample.myhost.com" -out newcsr.csr -nodes -sha512 -newkey rsa:2048 It generates two…
vdenotaris
  • 363
  • 1
  • 3
  • 6
23
votes
1 answer

PEM, CER, CRT, P12 - what is it all about?

I hope my question is not too general, but I find the topic of storing asymmetric keys very confusing.. Here's how I understand it: Using openSSL I can generate my RSA keys pair: openssl genrsa -out private.pem gives me a PEM file which includes…
mnj
  • 379
  • 1
  • 2
  • 7
10
votes
1 answer

Is there an official standard and/or name for PEM certificate bundles?

This is a question that's not really about security proper. It's about security/crypto nomenclature. It's been bugging me a bit, so here goes: I know two approaches for bundling related certificates/keys together: Heavy weight approach: PFX. There…
StackzOfZtuff
  • 17,783
  • 1
  • 50
  • 86
4
votes
2 answers

Why to use .PEM file in ssh process

So I come from windows background and new to SSh. We are in Linux environment now and as much as I like SSh and see its benefits, what I have realized is that it can be implemented in different ways. Now, for the longest times, we have been using…
Lost
  • 415
  • 4
  • 7
3
votes
1 answer

Why PEM encodings of EC public and private keys use different headers?

Manual page for OpenSSL ec command states: The PEM private key format uses the header and footer lines: -----BEGIN EC PRIVATE KEY----- -----END EC PRIVATE KEY----- The PEM public key format uses the header and footer lines: …
Konstantin Shemyak
  • 639
  • 5
  • 12
3
votes
1 answer

"openssl crl" verify gives "Error getting CRL issuer certificate"

File A - This is my CRL File - http://pastebin.com/yvstfPTD File B - It's signed by this cert - http://pastebin.com/T1pXZSat File C - The CRL signing cert has been issued by this CA http://pastebin.com/Q82PZCh1 File B & C are in directory dir1 When…
user93353
  • 1,982
  • 3
  • 19
  • 33
2
votes
1 answer

What is LS0... encoding of a PKI certificate?

I am looking through a set of PKI certificates and key strings that are specified in a kubernetes yaml file. They are used for testing. Some of the strings are keyed (as in yaml key-value) as crt.pem. All of the strings have the following…
errolflynn
  • 123
  • 4
2
votes
2 answers

How to convert a certbot certificate private key to "Unencrypted PEM encoded RSA"?

I use certbot to generate ssl cert for my domain. Then I use the following commands to copy the content to clipboard cat ./letsencrypt/live/mycompany.com/cert.pem |pbcopy cat ./letsencrypt/live/mycompany.com/privkey.pem |pbcopy and paste into…
Anthony Kong
  • 209
  • 2
  • 7
2
votes
2 answers

How To decrypt a private key stored in PEM format file

I manage a system that stores RSA private keys. The user can insert the keys either encrypted or clear text (it's always PEM though). the user also insert a passphrase. using the openSSL API (and not CLI), I have two questions: is there an API that…
amigal
  • 193
  • 3
  • 9
1
vote
1 answer

converting just a public key from PEM to DER using openssl

There are plenty of instructions for converting PEM certificates to DER which also pop up when looking for ways to convert public keys. These are among the options offered: openssl x509 -in cert.pem -out cert.der openssl rsa -in cert.pem -out…
Banyoghurt
  • 41
  • 6
1
vote
1 answer

Is this a PEM certificate?

I'm doing research on certificates and I've managed to find a dataset. It is a single large text file where each line appears to be a PEM encoded certificate but I am unable to load them using pythons asn1crypto.x509 although I am able to load my…
Nullman
  • 215
  • 1
  • 6
1
vote
1 answer

What's the block cipher mode of my PEM certificate?

How can I find out the mode block cipher used in a PEM certificate I have? It's been generated with an intermediate CA that does sha256WithRSAEncryption but I need to find out if it's a GCM or CBC to properly configure some devices.
dquake
  • 11
  • 1
1
vote
2 answers

How to encode a CMS or S/MIME PEM file with OpenSSL not encrypted or digitally signed?

We developed an application that reads a CMS encoded PEM file with this command: $ openssl cms -verify -in filepath -inform PEM -noverify The file is digitally signed, but we don't care about it, as we only want to extract the contents inside (it…
pragmatic_programmer
  • 113
  • 4
1
vote
1 answer

How do I verify that an ssh public/private keypair go together, is it different for openssl and ssh-key generated keys?

Generating a Private Key... $ openssl genrsa -out ./oci_api_key.pem 2048 Generate a Public Key...from the private key: I'm trying to generate a public key from a private key in PEM format (the Base64 of a DER) by running: $ openssl rsa -pubout -in…
leeand00
  • 1,297
  • 1
  • 13
  • 21
1
vote
1 answer

Loading a passphrase-protected private SSH key from a file with the cryptography Python module

I am trying to load a passphrase-protected private SSH key from a file using the cryptography Python module. However, I'm not exactly sure how to proceed. The following yields a Crypto.Util.Padding.PaddingError: Padding is incorrect. error. def…
Joey Dumont
  • 121
  • 5
1
2 3