Can an SSL certificate be on a single line in a file (no line breaks)?

Question

SSL certificates by default have line breaks after 67 characters. I'm trying to create SSL certificate files using Chef. Essentially I want to create the entire certificate file from a string variable without any line breaks. I've tried this a few times to no avail (Apache complains about not being able to find certificate).

I don't see why line breaks in an SSL cert would be necessary. Any ideas if it's possible to have a cert without any line breaks in the file?

score 30 · Accepted Answer · answered Jan 13 '13 at 20:43

30

No, the certificate won't be handled properly without the line breaks - software will fail to parse it.

If you're trying to pass it in a string, why not just include them in it? (\n)

answered Jan 13 '13 at 20:43

Shane Madden

112,982
12
174
248

1

Yep, should have thought of that. Using the \n character works. Thanks! – wrangler Jan 13 '13 at 20:50

score 30 · Answer 2 · edited Aug 24 '22 at 18:54

I found this script handy in making the file.

awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}'  ca.pem

This will take a standard PEM file on multiple lines, replace the "hidden" newline characters with \n, and print the output as a single line.

For example, this will make the following PEM file...

look like this output...

I found this useful when trying to upload an SSL certificate via the Rancher REST API, and couldn't get the encoding correct.

Thanks! I was wondering how to put certificate as an attribute in chef environment json file, this worked great. — Jacek Sztandera, Nov 20 '19 at 14:20
For those who need only the inline string without "\n" in each endline use "awk 'NF {sub(/\r/, ""); printf "%s",$0;}' ca.pem" — José Manuel Blasco, Jan 25 '21 at 10:00
Example useful usage: embedding a PEM formatted key or certificate in a JSON file where we can't have string spanning multiple lines. — Thomas B in BDX, Sep 22 '21 at 14:18

score 8 · Answer 3 · edited Oct 07 '21 at 06:58

8

It's a standard, and you should follow.

The RSA standards (e.g. RFC 2459) only define a binary representation for keys. In practice, like OpenPGP keys (RFC 4880), they are often encoded in base 64 using the otherwise obsolete PEM standards (RFC 1421).

The PEM printable encoding section says:

To represent the encapsulated text of a PEM message, the encoding function's output is delimited into text lines (using local conventions), with each line except the last containing exactly 64 printable characters and the final line containing 64 or fewer printable characters.

edited Oct 07 '21 at 06:58

Community

1

answered Nov 24 '17 at 00:36

johnnychen

81
1
3

2

2459 is long obsolete (by 3280 in 2002 and 5280 in 2008) but this particular point (using ASN.1 DER which is binary) hasn't changed. OTOH [7468](https://tools.ietf.org/html/rfc7468) more recently (2015) makes official the de-facto PEM-style formats for several things including certs. – dave_thompson_085 Nov 24 '17 at 04:39

score 2 · Answer 4 · answered Jan 13 '13 at 20:45

2

The line length, and so the line breaks, are due to 64-bit encoding used in the certificate files: see this Wikipedia article, for instance, http://en.wikipedia.org/wiki/Base64

Put newline characters (\n) into your string variable, instead.

answered Jan 13 '13 at 20:45

ramruma

2,730
1
14
8

2

Sorry but the line length of 64 printable characters has nothing to do why the base64 encoding. – hoang Aug 10 '20 at 09:01

score 1 · Answer 5 · edited Dec 15 '21 at 13:40

1

If -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines are not required for the CLI tool or API being used to pass the certificate, then just use:

awk 'NR>2 { sub(/\r/, ""); printf "%s\\n",last} { last=$0 }' crt.pem

edited Dec 15 '21 at 13:40

Exadra37

103
4

answered Mar 02 '21 at 14:44

Tombart

2,013
3
27
47

score 0 · Answer 6 · answered Aug 23 '22 at 23:32

0

You can convert a one-line certificate string by adding delimiters and wrapping at character 67.

(
  echo "-----BEGIN CERTIFICATE-----"; 
  echo $CERTIFICATE | sed -e "s/.\{67\}/&\n/g"; 
  echo "-----END CERTIFICATE-----";
) > certificate.pem

answered Aug 23 '22 at 23:32

Ryan

105
6

Can an SSL certificate be on a single line in a file (no line breaks)?

6 Answers6