OpenSSL RSA extract public key with .cer format

Question

I'm using openSSL to create RSA public and private key. I create success, and output is 2 keys with format private_key.pem and public_key.pem.

So, the requirement is public key need to be in .cer extension, Base 64 format and start with header: -----BEGIN

I do some researches but can't find to to convert pem to cer

Any ideas? Thanks.

P/S: Here is script that I used to generate key:

openssl genrsa -out private_key.pem 2048
openssl rsa -in private_key.pem -outform PEM -pubout -out public_key.pem

Update

Finally, I found solution for this, just for those who need it.

set OPENSSL_CONF=C:\Program Files (x86)\GnuWin32\share\openssl.cnf
openssl genrsa -out private_key.pem 2048 -sha256 -passout pass:abc123
openssl req -new -x509 -sha256 -key private_key.pem -out public_key.cer -days 3650

Stack Overflow is a site for programming and development questions. This question appears to be off-topic because it is not about programming or development. See [What topics can I ask about here](http://stackoverflow.com/help/on-topic) in the Help Center. Perhaps [Super User](http://superuser.com/) or [Unix & Linux Stack Exchange](http://unix.stackexchange.com/) would be a better place to ask. — jww, Sep 20 '17 at 08:04
Possible duplicate of [How to convert .pem into .key?](https://stackoverflow.com/questions/19979171/how-to-convert-pem-into-key) — Camille G., Sep 20 '17 at 08:36
I think this question is "how do I make a certificate from a key?". There's mild ambiguity (per an answer) about CER as CERtificate and as Canonical Encoding Rules for ASN.1 data. But I think there're enough clues in the question that they mean certificate. — bartonjs, Sep 21 '17 at 04:46

score 0 · Answer 1 · answered Sep 26 '17 at 15:59

For your public key to start with header: -----BEGIN, directly generate a base64 certificate with the private key.

openssl genrsa -out key.pem 2048
openssl req -new -x509 -days 1826 -key key.pem -out ca.crt

This will generate a self-signed certificate embedded with the relative public key which is valid for 5 years. Or use,

openssl req -new -key key.pem -out cert.csr

to generate a certificate signing request and get it signed by a Root.

score -1 · Answer 2 · edited Oct 07 '21 at 13:31

PEM is a normative encoding format (see RFC-7468), specifically designed to be included in mails, so it is only using a basic character set. DER is another normative encoding format, using a binary encoding scheme.

CER is not normative, it is a file extension often used to convey certificates (or, less often, keys).

Since CER is sometimes used as an extension for files containing DER encoded cryptographic material, people misuse the CER acronym and talk about CER encoding. But this has no sense. Finally, some other people talk about CER files for PEM encoded material.

I do some researches but can't find to to convert pem to cer

You will not, this has no sense: the way you have created your keys made them already PEM encoded.

So, the only thing you may need to do is converting your key files encoded in PEM to DER format, whatever the filename extension is.

To do that, use openssl:

openssl rsa -inform PEM -in private_key.pem -outform DER -out private_key.der
openssl rsa -pubin -inform PEM -in public_key.pem -outform DER -out public_key.der

OpenSSL RSA extract public key with .cer format

2 Answers2