So maybe I'm thinking about this too hard, or maybe I'm missing a piece of information.

We'll use Google for this example. Say I wanted to obtain the modulus of Google's current public key. Well I can do this relatively simply using OpenSSL:

openssl s_client -connect www.google.com:443 | openssl x509 -text -pubkey

Great, so now I export that into a pem file. So now I have their certificate and their public key. Let's discard their certificate for this instance. Also using OpenSSL, I can list the raw hexadecimal value of the modulus:

openssl rsa -in pubKey.pem -pubin -text -noout

Now that lists this information:

Public-Key: (2048 bit) Modulus: 00:c3:d5:12:42:8a:36:02:f5:77:01:8b:f6:83:2f: ab:c5:c7:00:e4:c0:3e:94:33:3a:2e:7a:2d:37:30: c0:6c:75:67:d4:13:d0:30:b1:11:34:16:21:6f:95: 99:b0:f6:31:3c:55:51:b9:3f:8c:c3:63:50:b9:d0: 03:7f:bb:76:53:66:80:4e:3e:51:d6:77:e6:5c:f5: 38:b1:19:88:7b:86:f8:2d:39:d0:12:4c:d0:6a:5e: 37:f1:bb:22:47:ec:d8:08:ca:06:81:44:4b:11:ef: 51:aa:e6:96:b8:ad:ed:6b:15:be:01:4b:bc:60:c9: df:42:0a:df:d3:8b:e5:b0:03:ac:18:ef:c3:f8:3a: 96:5e:a6:77:61:fe:36:1e:f5:f2:aa:83:1f:69:d4: 79:5d:69:a9:d9:a1:18:a2:98:cd:e6:3d:5b:1e:0f: a9:66:c8:42:f2:ba:b0:74:e8:5f:b3:b5:30:6d:79: a9:e8:9f:9c:23:5f:51:aa:36:2e:35:a7:9a:08:76: f9:46:f0:34:de:70:1a:3d:4e:f7:34:68:e4:43:75: bf:20:58:54:66:1c:9f:6d:9b:9d:28:21:15:ae:89: a7:e9:6f:75:7e:22:49:93:85:c6:a4:c5:2b:1a:23: 92:f9:eb:8f:67:a8:26:56:e1:9f:66:e5:74:2a:01: 0c:17 Exponent: 65537 (0x10001)

Great! I have the hexadecimally encoded modulus. I've read many articles and have seen many websites that offer this, but, for future purposes, I'll just say that I don't necessarily prefer uploading keyfiles (public or private) to external services and "hoping" that they don't record it.

For experimental purposes, how might I obtain the plain decimal version of this modulus using a local client in Linux? I've seen a lot of posts showing that people have done it, but I'm having trouble figuring it out for whatever reason.

Also, I've heard a little bit about the prefixing "00" of this hexadecimal string (00:c3:d5:12:42...), about how it's just a bug. Can you give me more information on this, such as why it occurs and if it's relevant?

  • 4
    $\begingroup$ Actually, the prefix "00" is not a bug - instead, the tool is listing exactly what's in the ASN.1 (DER) of the public key, and for 2048 bit positive integers, the initial 0x00 is mandatory... $\endgroup$
    – poncho
    Jun 14, 2016 at 20:36
  • 8
    $\begingroup$ I'm voting to close this question as off-topic because it is about converting numbers between different representations, rather than cryptographic theory. This should be asked on Super User or perhaps Stack Overflow instead. $\endgroup$
    – yyyyyyy
    Jun 14, 2016 at 20:50
  • 2
    $\begingroup$ Note that a publickey is already public so someone 'recording' it doesn't matter. You don't want to upload a privatekey, but for RSA the modulus in the privatekey and publickey are defined to be the same, so to get the modulus the privatekey isn't needed. $\endgroup$ Jun 15, 2016 at 12:36
  • $\begingroup$ unix.stackexchange.com/questions/49850/… ... combine this with sed or grep and you should be golden. $\endgroup$
    – Maarten Bodewes
    Jun 15, 2016 at 19:12
  • $\begingroup$ Related: crypto.stackexchange.com/questions/45151/… $\endgroup$
    – mti2935
    Jan 10, 2021 at 15:14

1 Answer 1


You've downloaded Google's (or whomever's) certificate. You have it stored in a file called GoogleCert:

$ cat GoogleCert

Use the command openssl x509 -in FILENAME -noout -modulus argument to extract just the Modulus:

$ openssl x509 -in GoogleCert -noout -modulus

Copy and paste the HEX output into BC using the ibase=16 argument to indicate the input is in Hex:

$ echo 'ibase=16;AAC42564448507CB736A37F...9152FD0458ECF42145' | bc

Not the answer you're looking for? Browse other questions tagged or ask your own question.