Introduction

The article explains how to check the signature of a file signed with an X.509 certificate from the command line using OpenSSL.

The examples use EC Private Keys.

How to create a Signature for a File

Signing a File with a Private Key

This step is performed by the signer of a file.

In the below example the test.txt file is signed with the privatekey.pem Private Key file. The resulting binary signature is stored to the test.txt.sig file.

The signer will make available the Certificate/Public Key and signature file to 3rd parties.

openssl dgst -sign privatekey.pem -keyform pem -sha256 -out test.txt.sig -binary test.txt

How to check the Signature of a File

Extracting the Public Key from the X.509 Certificate

This step is performed by a user who wants to verify the authenticity of a file from its signature.

To check a signature with OpenSSL use the Public Key that is related to the Private Key the given file was signed with. From the given certificate.pem X.509 certificate file extract the Public Key to the publickey.pem file .

openssl x509 -in certificate.pem -noout -pubkey > publickey.pem

Checking the Signature by use of the Public Key

In this step the publickey.pem Public Key file is used to check if the test.txt.sig signature file matches the test.txt file.

openssl dgst -verify publickey.pem -keyform pem -sha256 -signature test.txt.sig -binary test.txt

Possible results include

• Verified OK
  • The Public Key and signature for the signed file match.
• Verification Failure
  • The Public Key and signature for the signed file do not match.