Digital signature for a file using openssl

CryptographyOpensslRsa

Cryptography Problem Overview


Is there a way to digitally sign a x509 certificate or any document using openssl?

Cryptography Solutions


Solution 1 - Cryptography

To Generate Private Key

openssl genrsa -out privatekey.pem 2048

To Sign

openssl dgst -sha256 -sign privatekey.pem -out data.txt.signature data.txt

To Generate The Public Key

dgst -verify requires the public key

openssl rsa -in privatekey.pem -outform PEM -pubout -out publickey.pem

To Verify

openssl dgst -sha256 -verify publickey.pem -signature data.txt.signature data.txt
  • In case of success: prints "Verified OK", return code 0
  • In case of failure: prints "Verification Failure", return code 1

Solution 2 - Cryptography

Yes, the dgst and rsautl component of OpenSSL can be used to compute a signature given an RSA key pair.

Signing:
openssl dgst -sha256 data.txt > hash
openssl rsautl -sign -inkey privatekey.pem -keyform PEM -in hash >signature
Verifying just the signature:
openssl rsautl -verify -inkey publickey.pem -pubin -keyform PEM -in signature

Update: Capturing Reto's comments from below because this is an important nuance. Presumably if you are going to the trouble to verify, you want to know the signature was produced on the plaintext to which it is attached:

This might sound obvious for some but: Be aware, rsautl verify just decrypts the file signature. The output of this call is guaranteed to be produced by the owner of the private key, but beside that nothing else is being checked. So to actually verify the consistency of data.txt you have to regenerate the digest and then compare it against the output of openssl rsautl -verify.

Verifying that the owner of the private key does vouch for data.txt:
openssl dgst -sha256 -verify publickey.pem -signature signature data.txt

For this operation, openssl requires the public key, the signature, and the message.

Solution 3 - Cryptography

To digitally sign document in openssl it will work

For this first your certificate should be trusted it would be look like this

-----BEGIN TRUSTED CERTIFICATE-----
MIIDbjCCAlYCCQCOyunl25ProDANBgkqhkiG9w0BAQUFADB5MQswCQYDVQQGEwJJ
...
-----END TRUSTED CERTIFICATE-----

Then use following command

smime -sign -signer certificate.pem -inkey private.key -in test.txt \
    -out test1.txt -from ashish -to singhal

Attributions

All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestionAjay kumarView Question on Stackoverflow
Solution 1 - CryptographyretoView Answer on Stackoverflow
Solution 2 - CryptographyAnders LindahlView Answer on Stackoverflow
Solution 3 - CryptographyAshish SinghalView Answer on Stackoverflow