Getting an OpenSSL public key in PEM form, from a private key or a certificate.

[Robin H. Johnson]

Hi,

I'm working on a project making large use of OpenSSL to individually
encrypt items inside a database, but I've hit a stumbling block.

There appears to be absolutely no native PHP way (eg without a shell
call to openssl) to get the PEM encoded form of a public key, given
the private key and applicable passphrase.

The closest that can be gotten is a resource key, via:
$tmp = ... // PEM encoded certificate
$pubkey = openssl_pkey_ge t_public($tmp);
From this point however, there is still no way to get PHP to give me
the public key in a PEM encoding, for storage in the database. I've
tried all of the export functions, with various warnings returned from
them.

Getting to the above point from scratch requires generating a
certificate request from the private key, and then a self-signed
certificate from that CSR. While this is doable, leaving out the
self-signed certificate step would produce a large increase in
performance as well.

The openssl command I wish to emulate is:
openssl rsa -pubout <privkey.pem

Surely there must be a way to achieve this simple action?

[User1001]

Re: Getting an OpenSSL public key in PEM form, from a private key or a certificate.

Have you tried "openssl_pkey_e xport" ?


On Thu, 29 Jul 2004 19:27:04 -0700, Robin H. Johnson wrote:[color=blue]
> I'm working on a project making large use of OpenSSL to individually
> encrypt items inside a database, but I've hit a stumbling block.
>
> There appears to be absolutely no native PHP way (eg without a shell
> call to openssl) to get the PEM encoded form of a public key, given
> the private key and applicable passphrase.
>
> The closest that can be gotten is a resource key, via:
> $tmp = ... // PEM encoded certificate
> $pubkey = openssl_pkey_ge t_public($tmp);
> From this point however, there is still no way to get PHP to give me
> the public key in a PEM encoding, for storage in the database. I've
> tried all of the export functions, with various warnings returned from
> them.
>
> Getting to the above point from scratch requires generating a
> certificate request from the private key, and then a self-signed
> certificate from that CSR. While this is doable, leaving out the
> self-signed certificate step would produce a large increase in
> performance as well.
>
> The openssl command I wish to emulate is:
> openssl rsa -pubout <privkey.pem
>
> Surely there must be a way to achieve this simple action?[/color]

[Robin H. Johnson]

Re: Getting an OpenSSL public key in PEM form, from a private key or a certificate.

User1001 <supraexpress@g lobaleyes.net> wrote in message news:<pan.2004. 07.30.10.07.03. 774737@globaley es.net>...[color=blue]
> Have you tried "openssl_pkey_e xport" ?[/color]
[snip][color=blue][color=green]
> > the public key in a PEM encoding, for storage in the database. I've
> > tried all of the export functions, with various warnings returned from
> > them.[/color][/color]

NONE of the export functions work to export the public key. That's
openssl_pkey_ex port, openssl_x509_ex port, openssl_csr_exp ort.

openssl_pkey_ex port is the one that SHOULD work, but produces:
Warning: openssl_pkey_ex port(): supplied key param is a public key in
.... on line ...
Warning: openssl_pkey_ex port(): cannot get key from parameter 1 in ...
on line ...
and provides an empty string, returning false to show it failed.