I have written a Powershell script that reads the contents of a USB drive, reads files one by one and signs them in turn, generating a corresponding .sha256 file for each one.
I am having trouble getting this to either read files within subfolders or just to sign the folders on the root.
The command I am using to sign files is as follows;
C:\openssl\openssl.exe dgst -sha256 -sign $PriKey -out $path"\"$file".sha256" -passin pass:<passowrd> $path"\"$file
When it gets to a folder, it gives a 'Permission Denied' error (The user is a full administrator with full access to everything).
Does anyone know how I can get OpenSSL to either sign a folder (I realise folders are not conventional files) or to have Powershell read the contents of subfolders and sign the files contained there as per above?
I am relatively new to both.
Regards,
Jose
Related
Convert .crt, .csr, and .key files to .pfx or .p12 using powershell on Windows server 2016.
I have .cert, .csr, and .key files. But in order to execute the "netsh http add sslcert ..." command, I need the .pfx or .p12 file. And I need this to be done in powershell. Openssl is not an option.
I have accomplished the above using openssl. But Im restricted from downloading software now, so thats not an option any more. Im looking for equivalent of openssl pkcs12 -export -out domain.name.pfx -inkey key.key -in cert.crt command in powershell.
This is an old thread but since I was stuck on the exact same problem and finally found the correct answer that wasn't just everyone shouting to use openssl which sometimes isn't available I thought I'd share here for the next lucky soul.
There is a built-in windows utility call CertUtil which can be called from PS and will do exactly this. It's available out of the box at least as far back as server 2012, cant' speak to older versions.
certutil –MergePFX certfile.cer certfile.pfx
A couple things to keep in mind, the -MergePFX only prompts for the certfile not the key so:
Private key file must have .KEY extension.
Cert and key files must have the same base file name.
Cert and key file must be in the same directory.
If you can use .NET Core 3.0:
Load the certificate via cert = new X509Certificate2(certFile)
If the keyfile is PEM encoded (e.g. starts with "----- BEGIN ") then load it, remember what type it is (human or software), find the base64 contents between the header and footer, and run that through Convert.FromBase64String to get the BER/DER encoded format of the key.
key = RSA.Create()
key.ImportPkcs8PrivateKey(bytes, out _), key.ImportEncryptedPkcs8PrivateKey(password, bytes, out _), or key.ImportRSAPrivateKey(bytes, out _); depending on what format the private key file is in.
certWithKey = cert.CopyWithPrivateKey(key)
File.WriteAllBytes("new.pfx", certWithKey.Export(X509ContentType.Pkcs12, password))
If you can use .NET Core 2.1 / .NET Framework 4.7.2:
Load the cert, as above.
Load the key manually:
RSAPrivateKey
How to get RSACryptoServiceProvider public and private key only in c#
How to parse(Convert to RSAParameters) X.509 private key in C#?
PKCS#8 PrivateKeyInfo
Digital signature in c# without using BouncyCastle
PKCS#8 EncryptedPrivateKeyInfo
X509Certificate2.Import with NCRYPT_ALLOW_PLAINTEXT_EXPORT_FLAG (ImportEncryptedPkcs8Overwrite method)
Use CopyWithPrivateKey/Export/WriteAllBytes as above
If you're stuck on something older:
You could try loading the cert, manually loading the key into an RSACryptoServiceProvider, using cert.set_PrivateKey, and exporting that. Only works on .NET Framework (eliminated from .NET Core because it has too many side effects, especially when done to a cert already in a persisted certificate store).
I've created a power shell script that sets the SSL based on a provided PFX file.
Using the VSTS pipeline, what is the recommended way of passing PFX file to the script?
Including PFX file in a solution
getting the PFX file path on a target environment (contains dependency,
assuming that PFX file is already placed on target environment)
any other solution...?
The common way to pass authentication to the script is using option 1 (Including PFX file in a solution) as you listed.
After adding the pfx file into your solution, you can import certificates and private keys by import-PfxCertificate.
Detail usage and examples of Import-PfxCertificate, you can refer this document.
I'm trying to implement Sparkle into my macOS project using cocoapod.
But when following the documentation I seem to have a problem creating the public .pem file.
Command used in Terminal;
.ssh $ ssh-keygen -t dsa -b 1024
Generating public/private dsa key pair.
Enter file in which to save the key (/Users/jorgen/.ssh/id_dsa): dsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in dsa.
Your public key has been saved in dsa.pub.
According to the documentation I should have a file called dsa_pub.pem but all I end up with is dsa.pub
If anyone has a couple of minutes to give me simple step-by-step instructions how to set this up, I would be immensely appreciative.
I was going to use a DropBox folder as the https:// address. I archive the app into a .app as far as I can understand, I would zip this and put it in the DB folder? What else goes in there?
Download sparkle: https://sparkle-project.org
go to the bin folder inside the archive
open that folder in Terminal (drag and drop from folder)
call ./generate_keys to generate dsa_priv.pem and dsa_prb.pem in the same folder
I have a need to obtain a thumbprint from a pfx file on the filesystem without being prompted for a password that requires manual input.
I'm running this as part of an installer where the user specifies the path to the certificate on the filesystem (Not in the store). And the user specifies the password for the certificate. From that point, i need the thumbprint.
So this is simply a matter of discovering a tool which i can pass a path and password to a pfx file and return the thumbprint. I've tried several tools, but even OpenSSL compiled for windows, and it still prompts for the password and gives back a lot more info than just the thumbprint. It needs to be 100% programmatic and without further user intervention.
I'd love to hear any ideas on how to do this. This will be on Windows Server machines only. Thanks!
I found a way to do this - it involves downloading OpenSSL for windows and using that tool to convert and using powershell to read it out.
Conversion
& openssl pkcs12 -in C:\LocalHost.pfx -out C:\mycertificates.crt -nokeys -clcerts -passin pass:ActualPassword
Read In
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\mycertificates.crt")
$thumbprint = $cert.Thumbprint
write-host $thumbprint
So i had to convert to crt/cer first and then read using X509Certificate2.
When creating .pfx (pkcs#12) file, the internal storage containers, called "SafeBags", may also be encrypted and signed.
By default, OpenSSL encrypts the certificate along with its private key, which means it is not possible to get its thumbprint without knowing password.
When creating a new pfx, you can explicitly add -certpbe NONE to avoid encrypting the certificate.
For more details check -certpbe OpenSSL's man page
I am using signtool.exe to sign exe file.
I am trying to embed my exe file with the .pfx certificate along with the signed hash of exe(generated signed hash using openssl). I am able to sign only with certificate. But I need to embed the signed hash in the exe as well. Probably signtool.exe sign /as could help. /as option does not expect any argument so not able to pass my hash there.
Could someone please help me sign my exe with certificate and hash.
Thanks,
The version of Signtool shipped with the Windows 10 SDK includes the capability to embed a signed hash into an exe.
From the following page:
https://vcsjones.com/2017/05/07/custom-authenticode-signing/
Starting in the Windows 10 SDK, two new command line switches are available, dg and di. Recall that a signature is always performed on a hash on Authenticode. The dg option changes signtool’s behavior to output a digest that you can sign using anything you’d like. Let’s try this on a copy of notepad.exe.
signtool sign /dg "C:\scratch\dir" /fd SHA256 /f public-cert.cer notepad.exe
This takes a file to a public certificate - there is no key in
public-cert.cer. You could also use the /sha1 option to specify a
certificate in the certificate store that also has only a public key.
This will output a few files in the “C:\scratch\dir” directory. The
digest is the one with the “.dig” extension. This file will have the
Base64 encoded digest to sign. Next, using your custom tool, sign the
digest with the private key for the certificate. You should decode the
Base64 signature before signing if the signing API expects a raw
binary digest.
Next, encode your signature in base64 and place it in a file in the
“C:\scratch\dir” directory with the same name as the digest file, with
the “signed” extension. For example, “notepad.exe.dig.signed”.
The next step is to ingest the signed digest along with the rest of
the Authenticode signature to complete the signing.
signtool sign /di "C:\scratch\dir" notepad.exe
This will complete the signing process, and we now have our own signed
copy of notepad.exe. Appending a signature is done just as before,
except with the /as flag.
This provides great flexibility for signers to use non CSP / CNG
signing options, or offloading the signing process. Signtool can now
also sign just a plain digest file using the /ds option. If you have a
dedicated server for performing Authenticode signing, you can now use
the /dg, /ds, /di options so that only a very small file needs to be
moved to the signing server, instead of the entirely binary if they
are large in size.