Thanks for the response Dirk.
I tried, but could not see the certificate public key algorithm - as
x509v3-ssh-rsa or x509v3-rsa2048-sha256.
I use below openssl commands to generate the user certificate:
openssl req -nodes -new -x509 -keyout userkey.pem -out
userreq.pem -days 365 -config openssl.cnf
openssl x509 -x509toreq -in userreq.pem -signkey userkey.pem -out tmp.pem
openssl ca -config openssl.cnf -extensions usr_cert -out
usercert.pem -infiles tmp.pem
I tried varying the bits size (1024/2048/4096) and default_md
(sha1/sha256/sha512) in the openssl.cnf file.
Could anyone please share the steps to generate user certificates of
type: x509v3-ssh-rsa and x509v3-rsa2048-sha256 ?
Thanks & Regards,
Murugesh P.
On 8/24/21, Dirk-Willem van Gulik <dirkx@xxxxxxxxxxxxxx> wrote:
> On 24 Aug 2021, at 09:47, murugesh pitchaiah <murugesh.pitchaiah@xxxxxxxxx>
> wrote:
>>
>> Hi,
>>
>> I am working on generating the x509v3 certificates for ssh user. I see
>> with the default_md as 'sha256', in openssl.cnf file, the
>> key/certificate is generated with algorithm type as 'x509v3-sign-rsa'.
>>
>> I see its signature algorithm is :
>>
>> Signature Algorithm: sha256WithRSAEncryption
>> Public Key Algorithm: rsaEncryption
>> Public-Key: (2048 bit)
>>
>>
>> Can any one please share how to generate certificate for
>> x509v3-ssh-rsa and x509v3-rsa2048-sha256 ? Basically looking for
>> difference between these three type of public key algorithms ,and how
>> to generate certificate of these types:
>>
>> x509v3-sign-rsa, x509v3-ssh-rsa and x509v3-rsa2048-sha256
>>
>> Because, even for x509v3-sign-rsa - I see the size is 2048 bit and it
>> is sha256. Is it something to vary in 'default_md' (or newkey rsa:size
>> and -sha) fields to vary to generate these different cert types ?
>
> Try something like
>
> openssl req -new -x509 -newkey rsa:1024 -sha256 -keyout /dev/stdout -nodes
> -subj /CN=foo |\
> openssl x509 -pubkey -noout | openssl rsa -text -pubin -noout
>
> openssl req -new -x509 -newkey rsa:1024 -sha256 -keyout /dev/stdout -nodes
> -subj /CN=foo |\
> openssl x509 -text -noout | grep Signature
>
> And vary the newkey argument to see what it actually generates as an RSA
> key.
>
> In this example a 1024 bit one. You can also vary sha256 to things like md5,
> etc.
>
> Dw.
