0
$\begingroup$

I need to get these values ​​from pem and der files. Is there Python and C code or openssl command for these results?

Example cert in PEM format:

   -----BEGIN CERTIFICATE-----
    MIIDTTCCAjWgAwIBAgIBATANBgkqhkiG9w0BAQsFADBHMRQwEgYDVQQDDAtSb290
    IENBIFJTQTEMMAoGA1UECgwDT0NBMQswCQYDVQQGEwJOTDEUMBIGCgmSJomT8ixk
    ARkWBE9DVFQwIBcNMjAwMjEyMTgxMDI3WhgPMjA2MDAyMDIxODEwMjdaMEcxFDAS
    BgNVBAMMC1Jvb3QgQ0EgUlNBMQwwCgYDVQQKDANPQ0ExCzAJBgNVBAYTAk5MMRQw
    EgYKCZImiZPyLGQBGRYET0NUVDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
    ggEBAJ0gKwiY8Yj5T+SwZCQB3evp2y65BoVdBlnL91FzpuZ1LP9i0C4dQVcjN59W
    d3lDskb9njjm41ds57zAUEesMwomFy+DfXd2zDSoBpmFCJuoW3bD+8xN1ISfrEI0
    vQPTMRtyfaue1CYo55+4Fkv0zLEbjSOx3Sl+9ciwQ4i/x6hDjclu5JXx9Bom/oR2
    +xlHZEfpGogyDvQB3al+GsOCOk9Y7kA8EaVDPLeeI+CJdOS4syoZdyEiA6cO+kAH
    0tE+Rl5Pqf3wabuO1ebTLenswa7xLrUGQ9rURmXTJQ2+23c3YsXOGgMZ5M7H2R2i
    sOt2S62t28aVs62+PwQrqh/X4vkCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAO
    BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFNSqKyVEMyNJoqivS0wO565HVoOiMA0G
    CSqGSIb3DQEBCwUAA4IBAQAtxUSnf+pb+dgLPAtLgoMLsc+CgvoeEpHF1aLWNgcc
    VSC2L0frxtpERl3xjxE9ttc+3mE6KA2UQFhf4Md4vCPf60GZw44rFl1Rj9PwrLA9
    c2AtLjcDkthhmZylgEjorzyox3wVW5pbOWRP38lDz9gpqJCzTYmmm+9skNS09/gq
    M5lYhAqBjKjLiyKylwKWdw9EOkUxnSlg4aicn83+1cdD0iNM+z6lIP5cxvQu2/f6
    8KJ9JkTofQzdyPH4l/JvuSwmXnfWR3O8JTJjAq8Z5XoqduJXhEB73Xvamdah1PB0
    BJHAh45odouHCmtG6TqRUgoFVNZDLdNurVXXzn5cnL+t
    -----END CERTIFICATE-----

Example output:

  "certificateHashData": {
    "hashAlgorithm": "SHA256",
    "issuerNameHash": "f405cb5ba4efe79d4863495e186413c551f7d98dd021030573e169146a763056",
    "issuerKeyHash": "3e1518dc6e867ea55d699922be7be6898fb5abf459709c086e17ac4760682da9",
    "serialNumber": "1"
    ]}
$\endgroup$
1
$\begingroup$

Expanding on what Maarten shows, openssl asn1parse can display the details, AND can also extract encoded parts of the certificate (or other ASN.1 structure):

>openssl asn1parse -i <cry87661.crt
    0:d=0  hl=4 l= 845 cons: SEQUENCE
    4:d=1  hl=4 l= 565 cons:  SEQUENCE
    8:d=2  hl=2 l=   3 cons:   cont [ 0 ]
   10:d=3  hl=2 l=   1 prim:    INTEGER           :02
   13:d=2  hl=2 l=   1 prim:   INTEGER           :01
   16:d=2  hl=2 l=  13 cons:   SEQUENCE
   18:d=3  hl=2 l=   9 prim:    OBJECT            :sha256WithRSAEncryption
   29:d=3  hl=2 l=   0 prim:    NULL
   31:d=2  hl=2 l=  71 cons:   SEQUENCE
   33:d=3  hl=2 l=  20 cons:    SET
   35:d=4  hl=2 l=  18 cons:     SEQUENCE
   37:d=5  hl=2 l=   3 prim:      OBJECT            :commonName
   42:d=5  hl=2 l=  11 prim:      UTF8STRING        :Root CA RSA
   55:d=3  hl=2 l=  12 cons:    SET
   57:d=4  hl=2 l=  10 cons:     SEQUENCE
   59:d=5  hl=2 l=   3 prim:      OBJECT            :organizationName
   64:d=5  hl=2 l=   3 prim:      UTF8STRING        :OCA
   69:d=3  hl=2 l=  11 cons:    SET
   71:d=4  hl=2 l=   9 cons:     SEQUENCE
   73:d=5  hl=2 l=   3 prim:      OBJECT            :countryName
   78:d=5  hl=2 l=   2 prim:      PRINTABLESTRING   :NL
   82:d=3  hl=2 l=  20 cons:    SET
   84:d=4  hl=2 l=  18 cons:     SEQUENCE
   86:d=5  hl=2 l=  10 prim:      OBJECT            :domainComponent
   98:d=5  hl=2 l=   4 prim:      IA5STRING         :OCTT
  104:d=2  hl=2 l=  32 cons:   SEQUENCE
  106:d=3  hl=2 l=  13 prim:    UTCTIME           :200212181027Z
  121:d=3  hl=2 l=  15 prim:    GENERALIZEDTIME   :20600202181027Z
  138:d=2  hl=2 l=  71 cons:   SEQUENCE
  140:d=3  hl=2 l=  20 cons:    SET
  142:d=4  hl=2 l=  18 cons:     SEQUENCE
  144:d=5  hl=2 l=   3 prim:      OBJECT            :commonName
  149:d=5  hl=2 l=  11 prim:      UTF8STRING        :Root CA RSA
  162:d=3  hl=2 l=  12 cons:    SET
  164:d=4  hl=2 l=  10 cons:     SEQUENCE
  166:d=5  hl=2 l=   3 prim:      OBJECT            :organizationName
  171:d=5  hl=2 l=   3 prim:      UTF8STRING        :OCA
  176:d=3  hl=2 l=  11 cons:    SET
  178:d=4  hl=2 l=   9 cons:     SEQUENCE
  180:d=5  hl=2 l=   3 prim:      OBJECT            :countryName
  185:d=5  hl=2 l=   2 prim:      PRINTABLESTRING   :NL
  189:d=3  hl=2 l=  20 cons:    SET
  191:d=4  hl=2 l=  18 cons:     SEQUENCE
  193:d=5  hl=2 l=  10 prim:      OBJECT            :domainComponent
  205:d=5  hl=2 l=   4 prim:      IA5STRING         :OCTT
  211:d=2  hl=4 l= 290 cons:   SEQUENCE
  215:d=3  hl=2 l=  13 cons:    SEQUENCE
  217:d=4  hl=2 l=   9 prim:     OBJECT            :rsaEncryption
  228:d=4  hl=2 l=   0 prim:     NULL
  230:d=3  hl=4 l= 271 prim:    BIT STRING
  505:d=2  hl=2 l=  66 cons:   cont [ 3 ]
  507:d=3  hl=2 l=  64 cons:    SEQUENCE
  509:d=4  hl=2 l=  15 cons:     SEQUENCE
  511:d=5  hl=2 l=   3 prim:      OBJECT            :X509v3 Basic Constraints
  516:d=5  hl=2 l=   1 prim:      BOOLEAN           :255
  519:d=5  hl=2 l=   5 prim:      OCTET STRING      [HEX DUMP]:30030101FF
  526:d=4  hl=2 l=  14 cons:     SEQUENCE
  528:d=5  hl=2 l=   3 prim:      OBJECT            :X509v3 Key Usage
  533:d=5  hl=2 l=   1 prim:      BOOLEAN           :255
  536:d=5  hl=2 l=   4 prim:      OCTET STRING      [HEX DUMP]:03020106
  542:d=4  hl=2 l=  29 cons:     SEQUENCE
  544:d=5  hl=2 l=   3 prim:      OBJECT            :X509v3 Subject Key Identifier
  549:d=5  hl=2 l=  22 prim:      OCTET STRING      [HEX DUMP]:0414D4AA2B2544332349A2A8AF4B4C0EE7AE475683A2
  573:d=1  hl=2 l=  13 cons:  SEQUENCE
  575:d=2  hl=2 l=   9 prim:   OBJECT            :sha256WithRSAEncryption
  586:d=2  hl=2 l=   0 prim:   NULL
  588:d=1  hl=4 l= 257 prim:  BIT STRING

The SEQUENCE beginning at 31 is the Issuer name (and the one beginning 138 is the Subject name, which is the same as the Issuer in this cert because this cert is a selfsigned cert for a root CA) and the BIT STRING at 138 is the subjectPublicKey field within the subjectPublicKeyInfo substructure, which only for a selfsigned cert is the same as the issuer key, so:

>openssl asn1parse -i <cry87661.crt -strparse 31 -out cry87661.name
[snipped]
>openssl asn1parse -i <cry87661.crt -strparse 230 -out cry87661.keyx
[snipped]
>dir cry87661*
21/01/20  19:11             1,224 cry87661.crt
21/01/20  19:27               270 cry87661.keyx
21/01/20  19:13                73 cry87661.name

but these don't match your values:

>openssl sha256 <cry87661.name
(stdin)= e60bd843bf2279339127ca19ab6967081dd6f95e745dc8b8632fa56031debe5b

>openssl sha256 <cry87661.keyx
(stdin)= 89ea6977e786fcbaeb4f04e4ccdbfaa6a6088e8ba8f7404033ac1b3a62bc36a1
$\endgroup$
0
$\begingroup$

You can use openssl x509 -text -in cert_file.pem or openssl x509 -text -inform DER -in cert_file.der to retrieve the certificate as "text".

Online you can use lapo.it/asn1js to get the same information in a slightly different format.

However the fields you mention are not part of the certificate (check the lapo.it link or OpenSSL command line output). They seem to be hashes over the binary encoding of the name and subject public key of the CA certificate that is the parent of this certificate.

$\endgroup$
4
  • $\begingroup$ thanks.. but How can it be obtained as binary encoding.because it ended with ... without showing it all on the website. $\endgroup$
    – BRKZKN
    Jan 20 '21 at 19:48
  • $\begingroup$ I guess you'd have to use a library for that, then get the right information. Anything lib that supplies OCSP information should probably fit. The definition of the fields is here. So you need complete DER encoded subsections of the cert. Not fun, I'd look for a library that can create a CertID. $\endgroup$
    – Maarten Bodewes
    Jan 20 '21 at 20:27
  • $\begingroup$ openssl asn1parse -i [-inform der] <file gives you locally the same info as lapo.it, though not exactly the same format. This cert is selfsigned (and selfissued) so it doesn't really have a parent, although all certs that do have parents have the parent name in the Issuer field; if the goal actually is to do OCSP, which Q doesn't say, it makes no sense to do OCSP on a root since a root can't be revoked by the CA itself. Note 6960 says issuerNameHash is computed from the cert being checked i.e. the child while issuerKeyHash is computed from the issuer cert i.e. the parent $\endgroup$ Jan 21 '21 at 1:00
  • $\begingroup$ Ah, that makes a bit more sense actually. I was wrong footed because of the cert. $\endgroup$
    – Maarten Bodewes
    Jan 21 '21 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.