openssl + aws lb cheat sheet

# openssl + aws iam cheat sheet

# src: https://docs.aws.amazon.com/acm/latest/userguide/import-certificate-prerequisites.html

The certificate, private key, and certificate chain must all be PEM-encoded. PEM stands for Privacy Enhanced Mail but was never widely adopted an Internet mail standard. Instead, the PEM format is often used to represent a certificate or certificate request. It is base64-encoded and placed between a -----BEGIN CERTIFICATE----- header and an -----END CERTIFICATE----- footer

# download the sq.crt VerisignRoot CA certtificate

curl -O http://sg.symcb.com/sg.crt

# ok

# convert the root certificate to pem format

openssl x509 -text -inform DER -in sg.crt > sg.crt.pem

# OK

aws iam upload-server-certificate \

    --server-certificate-name <<service>>-<<app>>-<<date-valid-to>>-<<Issuer-CA>> \

    --certificate-body file://body.pem \ # BEGIN CERTIFICATE -> END CERTIFICATE

    --certificate-chain file://sg.crt.pem \ 

    --private-key file://private-key.key \ # rsa start -> rsa stop

    --profile prd

# ok

# create pem files from the cert files

while read -r f; do openssl x509 -in $f -text > $f.pem     ; echo done with $f ; done < <(find . -type f -name "*.cert" |sort)

# ok

# check the private keys ( *.key ) files

while read -r f ; do echo '### START '$f | less; openssl rsa -in $f -check 2>&1 | less ; echo '### STOP '$f | less ; done < <(find . -name '*.key')

# ok

# check the cert ( *.cert ) files

while read -r f ; do echo '### START '$f | less; openssl x509 -in $f -text -noout 2>&1 | less ; echo '### STOP '$f | less ; done < <(find . -name '*.cert')

# ok

# create the cert ( *.cert ) files

while read -r f ; do echo '### START '$f | less; openssl x509 -in $f -text -noout > "$f"".pem" 2>&1 | less ; echo '### STOP '$f | less ; done < <(find . -name '*.cert')

# ok 

# check the private key file

openssl rsa -in key-file.key -check

# src: https://www.sslshopper.com/article-most-common-openssl-commands.html

# Generate a new private key and Certificate Signing Request

openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key

# Generate a self-signed certificate 

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.crt

# Generate a certificate signing request (CSR) for an existing private key

openssl req -out CSR.csr -key privateKey.key -new

# Generate a certificate signing request based on an existing certificate

openssl x509 -x509toreq -in certificate.crt -out CSR.csr -signkey privateKey.key

# Remove a passphrase from a private key

openssl rsa -in privateKey.pem -out newPrivateKey.pem

# Check a Certificate Signing Request (CSR)

openssl req -text -noout -verify -in CSR.csr

# Check a private key

openssl rsa -in privateKey.key -check

# Check a certificate

openssl x509 -in certificate.crt -text -noout