<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Long response short, yes, you can.</div><div class="">Prepare and fill in your X509 object, perform the signature with your EVP_PKEY private key, format the resulting signature into a BIT STRING, place this BIT STRING into your previous X509 object, complete it with the AlgorithmIdentifier you choose when signing (it should already have been set in the TBSCertificate structure, just copy it from there).</div><div class="">The resulting X.509 certificate can be used for anything and is not limited for a SSL client verification usage.</div><div class=""><br class=""></div><div class="">In the previous paragraph, I assume your smart card contains the CA private key, and you want to sign certificates (either subCA or subscriber, it doesn’t matter). That’s how I understood your question.</div><div class=""><br class=""></div><div class="">If you want to do all this using only openssl CLI, that’s doable with a specially crafted config file declaring your engine and its parameters.</div><br class=""><div class="">
<div class="">Cordialement,</div><div class="">Erwann Abalea</div><div class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">Le 22 juil. 2015 à 11:57, Anirudh Raghunath <<a href="mailto:anirudhraghunath@rocketmail.com" class="">anirudhraghunath@rocketmail.com</a>> a écrit :</div><br class="Apple-interchange-newline"><div class=""><div class=""><div style="background-color: rgb(255, 255, 255); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 16px;" class=""><div id="yui_3_16_0_1_1437507453899_143096" class="">Thanks for the quick response. I am currently working with smart cards and am using the engine provided by openSC to access the private key in the smart card. Long story short I have the EVP_PKEY object with me. Can I use this to sign a certificate or some file which can be used for SSL client verification. </div><div id="yui_3_16_0_1_1437507453899_143096" class=""><br class=""></div><div id="yui_3_16_0_1_1437507453899_143096" class="">Merci</div> <br class=""><div class="qtdSeparateBR"><br class=""><br class=""></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;" class=""> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;" class=""> <div dir="ltr" class=""> <font size="2" face="Arial" class=""> On Wednesday, 22 July 2015 11:52 AM, Erwann Abalea <<a href="mailto:erwann.abalea@opentrust.com" class="">erwann.abalea@opentrust.com</a>> wrote:<br class=""> </font> </div> <br class=""><br class=""> <div class="y_msg_container"><div id="yiv4969948448" class=""><div class="">Bonjour,<div class="yiv4969948448"><br clear="none" class="yiv4969948448"></div><div class="yiv4969948448">An X.509 certificate is:</div><div class="yiv4969948448"><div class="yiv4969948448"><br clear="none" class="yiv4969948448"></div><div class="yiv4969948448">Certificate ::= SEQUENCE {</div><div class="yiv4969948448"> tbsCertificate TBSCertificate,</div><div class="yiv4969948448"> signatureAlgorithm AlgorithmIdentifier,</div><div class="yiv4969948448"> signatureValue BIT STRING }</div></div><div class="yiv4969948448"><br clear="none" class="yiv4969948448"></div><div class="yiv4969948448">What you produced with « openssl rsautl -sign » is the content of the « signatureValue » element (not its BIT STRING structure, only the inner content).</div><div class="yiv4969948448">What is missing is all the rest, and it can’t be produced by the sole « openssl x509 … » command.</div><div class="yiv4969948448"><br clear="none" class="yiv4969948448"></div><div class="yiv4969948448">Please refine your question.</div><div class="yiv4969948448"><br clear="none" class="yiv4969948448"><div class="yiv4969948448">
<div class="yiv4969948448">Cordialement,</div><div class="yiv4969948448">Erwann Abalea</div><div class="yiv4969948448"><br clear="none" class="yiv4969948448"></div><br clear="none" class="yiv4969948448Apple-interchange-newline">
</div>
<br clear="none" class="yiv4969948448"><div class=""><blockquote class="yiv4969948448" type="cite"><div class="yiv4969948448">Le 22 juil. 2015 à 11:17, Anirudh Raghunath <<a rel="nofollow" shape="rect" class="yiv4969948448" ymailto="mailto:anirudhraghunath@rocketmail.com" target="_blank" href="mailto:anirudhraghunath@rocketmail.com">anirudhraghunath@rocketmail.com</a>> a écrit :</div><br clear="none" class="yiv4969948448Apple-interchange-newline"><div class="yiv4969948448"><div class="yiv4969948448yqt9140975251" id="yiv4969948448yqt20022"><div class="yiv4969948448"><div class="yiv4969948448" style="background-color:rgb(255, 255, 255);font-family:HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;font-size:16px;"><div class="yiv4969948448" id="yiv4969948448yui_3_16_0_1_1437507453899_130158">Hello,</div><div class="yiv4969948448" id="yiv4969948448yui_3_16_0_1_1437507453899_130158"><br clear="none" class="yiv4969948448"></div><div class="yiv4969948448" dir="ltr" id="yiv4969948448yui_3_16_0_1_1437507453899_130158">I have used rsault -sign option to sign a text file which gives me a binary file. I would like to convert this to X509 so that I can use it in a ssl handshake. I understand the command:</div><div class="yiv4969948448" dir="ltr" id="yiv4969948448yui_3_16_0_1_1437507453899_130158"><br clear="none" class="yiv4969948448"></div><div class="yiv4969948448" dir="ltr" id="yiv4969948448yui_3_16_0_1_1437507453899_130158">openssl x509 -inform <format> -in <certfile> -out <cert.pem> </div><div class="yiv4969948448" dir="ltr" id="yiv4969948448yui_3_16_0_1_1437507453899_130158"><br clear="none" class="yiv4969948448"></div><div class="yiv4969948448" dir="ltr" id="yiv4969948448yui_3_16_0_1_1437507453899_130158">is used. I want to know what the parameters would be for a binary input file.</div><div class="yiv4969948448" dir="ltr" id="yiv4969948448yui_3_16_0_1_1437507453899_130158"><br clear="none" class="yiv4969948448"></div><div class="yiv4969948448" dir="ltr" id="yiv4969948448yui_3_16_0_1_1437507453899_130158">Thanks in advance. </div></div></div></div>_______________________________________________<br clear="none" class="yiv4969948448">openssl-users mailing list<br clear="none" class="yiv4969948448">To unsubscribe: <a rel="nofollow" shape="rect" class="yiv4969948448" target="_blank" href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br clear="none" class="yiv4969948448"></div></blockquote></div><br clear="none" class="yiv4969948448"></div></div></div><br class=""><br class=""></div> </div> </div> </div></div></div></div></blockquote></div><br class=""></body></html>