Subject: [dane] Extracting SPKI from a certificate/key

From: Tapio Sokura <[email-masked]>
Date: Mon, 22 Dec 2014 00:55:38 +0200

Hello,

I had some trouble finding out how to extract the SPKI from an x.509
certificate to use in TLSA records. I stumbled upon
https://www.huque.com/bin/gen_tlsa and based on matching the output, I
came up with the openssl/sha256sum command lines listed below. The first
one is based on the private key file and the second on an x.509
certificate that contains the same public key. Can someone verify these
produce the correct results for use with tlsa dane-ee spki sha-256
records? Naturally these exact syntaxes only work for RSA keys.

from private key:
openssl rsa -in private.key -outform der -pubout |sha256sum

from x509 certificate:
openssl x509 -in x509.crt -pubkey -noout|openssl rsa -pubin -outform
der|sha256sum

  Tapio

---

From: Viktor Dukhovni <[email-masked]>
Date: Sun, 21 Dec 2014 23:07:45 +0000

On Mon, Dec 22, 2014 at 12:55:38AM +0200, Tapio Sokura wrote:

> Can someone verify these
> openssl x509 -in x509.crt -pubkey -noout |
>	openssl rsa -pubin -outform der |
>	sha256sum

Basically correct.  In notices I send to sites whose TLSA records
are not right, I include the text below:

    ----- Snip -----
    To generate a TLSA "3 1 1" record from a certificate file in PEM
    format (using OpenSSL 1.0.0 or later):

	printf '_25._tcp.%s. IN TLSA 3 1 1 %s\n' \
	    $(uname -n) \
	    $(openssl x509 -in cert.pem -noout -pubkey |
		openssl pkey -pubin -outform DER |
		openssl dgst -sha256 -binary |
		hexdump -ve '/1 "%02x"')

    you can use the attached tlsagen script if you prefer,

	$ ./tlsagen cert.pem $(uname -n) 3 1 1

    or use the website:

	https://www.huque.com/bin/gen_tlsa
    ----- Snip -----

The above is not RSA-specific and works equally well for ECDSA
keys.  However, it requires OpenSSL 1.0.0 or later.  One really
should not be using OpenSSL 0.9.8 or earlier at this point, and
even 1.0.0 is reaching end-of-life.

-- 
	Viktor.