<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:16px"><div id="yui_3_16_0_1_1437507453899_180291" dir="ltr"><span id="yui_3_16_0_1_1437507453899_181054">Thank you for the extremely elaborate answer. Now I understand the big picture. I want to attach a file from the server side which can be collected in the client program(the test) and I want to sign it and send it back. I have the ssl server client connection ready through socket and ssl code. I want to know if there is a function to load the random file to the SSL_CTX object the way we do with certificates. Thanks anyways for taking the time to answer my trivial doubts :).</span></div> <br><div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;"> <div dir="ltr"> <font size="2" face="Arial"> On Wednesday, 22 July 2015 12:12 PM, Victor Wagner <vitus@wagner.pp.ru> wrote:<br> </font> </div> <br><br> <div class="y_msg_container">On Wed, 22 Jul 2015 09:17:43 +0000 (UTC)<br clear="none">Anirudh Raghunath <<a shape="rect" ymailto="mailto:anirudhraghunath@rocketmail.com" href="mailto:anirudhraghunath@rocketmail.com">anirudhraghunath@rocketmail.com</a>> wrote:<br clear="none"><br clear="none">> Hello,<br clear="none">> I have used rsault -sign option to sign a text file which gives me a<br clear="none">> binary file. I would like to convert this to X509 so that I can use<br clear="none">> it in a ssl handshake. I understand the command: openssl x509 -inform<br clear="none">> <format> -in <certfile> -out <cert.pem> is used. I want to know what<br clear="none">> the parameters would be for a binary input file. Thanks in advance. <br clear="none"><br clear="none">Unfortunately signed text file and certificate are quite different<br clear="none">things.<br clear="none"><br clear="none">Of course, certificate is signed electronic document. But it is<br clear="none">document of special binary format, which contains public key and<br clear="none">information about owner of corresponding private key.<br clear="none"><br clear="none">And typically, it is not signed by you, it is signed by Certificate<br clear="none">Authority (known to server).<br clear="none"><br clear="none">When you use certificate (and corresponding private key) during SSL<br clear="none">handshake, it means than server sends you something, you sign this<br clear="none">something using your private key and send signature to server along<br clear="none">with certificate.<br clear="none"><br clear="none">Server verifies signature under data, which it remembers it have been<br clear="none">sent to you, using public key contained in the certificate, and says<br clear="none">"Ok, this guy really owns private key corresponding to public key in<br clear="none">this certificate". It also verifies signature under certificate using<br clear="none">known beforehand and trusted CA certificates, to make sure that public<br clear="none">key stored in the certificate<br clear="none">really belongs to person mentioned in the certificate subject field.<br clear="none"><br clear="none">So, if you sign some text file using your certificate, this signature<br clear="none">cannot be used in the SSL handshake any way. Because you've signed some<br clear="none">text file, not a challenge send by server during SSL handshake.<br clear="none"><br clear="none">This signature proves that you, owner of private key,<br clear="none">have had access to<br clear="none">this text file (provided your private key is not compromised), but<br clear="none">there is no way to use this signature to prove that your are one, who<br clear="none">established connection with server. To prove so, you have to sign<br clear="none">something send to your from server, not some data, known beforehand. <br clear="none"><br clear="none">Really, option -sign of this utility may produce some signed document<br clear="none">format such as PKCS#7 or CMS, which contains signer's certificate.<br clear="none"><br clear="none">For same purpose which I've described above. If someone wants to verify<br clear="none">if you've signed this file, one should have your certificate, with<br clear="none">public key and your name in it. Simplest way to ensure this is to<br clear="none">attach certificate to the signed message. Then recipient of message can<br clear="none">validate certificate, extracted from message with known and trusted CA<br clear="none">and then use it to verify signature under message.<br clear="none"><br clear="none">If you want use such a curved way to extract certificate from card, it<br clear="none">is possbile, provided that your rsautl produces standard signed message<br clear="none">format, i.e PKCS#7<br clear="none"><br clear="none">may be<br clear="none"><br clear="none">openssl pkcs7 -inform der -in signedfile.bin -print_certs<br clear="none"><br clear="none">would do the trick and write certificate of one who signed the file into<br clear="none">filename.pem<br clear="none"><br clear="none">But this is not called "convert signed file to X509 format", it is<br clear="none">called "extract X509 certificate from signed file".<div class="yqt9388944396" id="yqtfd71180"><br clear="none">_______________________________________________<br clear="none">openssl-users mailing list<br clear="none">To unsubscribe: <a shape="rect" href="https://mta.openssl.org/mailman/listinfo/openssl-users" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>