...

Introduction

This document describes The article explains how to check the signature of a file signed with an X.509 certificate from the command line using OpenSSL.

The examples use EC Private Keys.

Extracting the Public Key from the X.509 Certificate

To check a signature with OpenSSL use the Public Key related to the Private Key the given file was signed with. Extract the Public Key to the pubkey.pem file from the given certificate.pem X.509 certificate file.

openssl x509 -in certificate.pem -noout -pubkey > pubkey.pem

How to create a Signature for a File

Signing a File with a Private Key

This step is performed by the signer of a file.

In this step the below example the test.txt file is signed with the privkeyprivatekey.pem Private Key file. The resulting binary signature is stored to the test.txt.sig file.

The signer will make available the Certificate/Public Key and signature file to 3rd parties.

openssl dgst -sign privkeyprivatekey.pem -keyform pem -sha256 -out test.txt.sig -binary test.txt

How to check the Signature of a File

Extracting the Public Key from the X.509 Certificate

This step is performed by a user who wants to verify the authenticity of a file from its signature.

To check a signature with OpenSSL use the Public Key that is related to the Private Key the given file was signed with. From the given certificate.pem X.509 certificate file extract the Public Key to the publickey.pem file .

openssl x509 -in certificate.pem -noout -pubkey > publickey.pem

Checking the Signature by use of the Public Key

In this step the pubkeypublickey.pem Public Key file is used to check if the test.txt.sig signature file matches the test.txt file.

openssl dgst -verify pubkeypublickey.pem -keyform pem -sha256 -signature test.txt.sig -binary test.txt

Possible results are include

• Verified OK
  • The Public Key and signature for the signed file match.
• Verification Failure
  • The Public Key and signature for the signed file do not match.

...