pkey public key extraction

[Viktor Dukhovni]

On Wed, Sep 20, 2023 at 07:28:46AM +0000, Doody, Stephen via openssl-users wrote:

> I'm hoping someone can point me in the right direction.

Perhaps walk you there step by step...

> We have a pem file that a colleague believes contains a private and a public key.

More likely, a private key and a (public key) X.509 certificate (a
certificate is basically a public key enclosed in a singed name binding
attestation).

> They want to extract the public key from the file and deploy that, so
> a 3rd party service can access our system.

Typically, the 3rd party would want your certificate, though some are
sophisticated enough to directly use a "bare" public key.  The
distinction is important, so you need to check *precisely* what they're
looking for.

> The command they suggested was:
> openssl pkey -in ourcert.pem -pubout -out pubkey1.pem

This extracts a bare public key from the first private key in the PEM
file.

> The pubkey.pem file that is created only contains the public key and
> nothing else, so the 3rd party service can no longer connect to our
> system as it doesn't recognise this as a valid certificate and
> complained that it was not trusted.

This makes no sense, because if they wanted a public key, they got one.
If they wanted a certificate, they should have asked for that, and not
given you incorrect instructions for getting just the key.  It seems
they need as much hand-holding as you do. :-(

> I've read through the man pages for pkey and x509 and I've also tried
> this: openssl x509 -in ourcert.pem -pubkey -out pubkey2.pem

This extracts two PEM objects, the "bare" public key *and* the
certificate (because you didn't also specify "-noout").

And apparently, it was the certificate they were looking for after all.

> The 3rd party service can now connect to our system but viewing the
> details of the pubkey2.pem file it looks identical to the original
> ourcert.pem file.

Almost identical, it wouldn't have your private key.

> Is pkey or x509 the right way to do this?

Apparently "x509", and you don't need the "-pubout" option, that's not
what they meant to ask you for.

> If it is pkey, how do I extract the public key so that it generates a
> valid certificate?

This makes no sense.  A public key is not a certificate, and does not
contain one.  It is the other way around.

-- 
    Viktor.