Description
Container with the openssl binary, giving the ability to work with cryptographic keys and certificates needed for web servers.
The openssl container provides an openssl command-line tool for using the various functions of the OpenSSL crypto library.
Using the OpenSSL tool, you can generate private keys, create certificate signing requests (CSRs), and display certificate information.
Usage
To get the openssl container image on your local system, run the following:
$ podman pull registry.access.redhat.com/ubi9/openssl
To run the openssl command inside the openssl container, run:
$ podman run --rm -v ./mykeys:/keys:z \
registry.access.redhat.com/ubi9/openssl \
<openssl_command>
This command performs the following actions:
- The
-v ./mykeys:/keys:z option mounts the mykeys folder on the host to the keys folder inside the container. The folder needs to be created if it does not exist already.
- This enables sharing the volume content between the container and the host. You can access the content of the
keys folder from the mykeys folder on the host even if you exit the container.
- The
z option is needed to set correct SELinux labels.
Examples of the <openssl_command> are the following:
Generate a private RSA key:
genpkey -algorithm RSA -out key.pem
- The default RSA key size is 2048 bits.
Generate a private Elliptic Curve (EC) key:
ecparam -genkey -name prime256v1 -noout -out ec256-key-pair.pem
- You have to specify the curve designation to generate an EC key pair.
- The EC keys are shorter than RSA keys, providing the same security. The advantages of EC keys are the reduced key size and hence speed.
- The JOSE ESxxx signatures require P-256, P-384, and P-521 curves.
- You could also use the
-name option with secp384r1 or secp521r1 values for 384 or 521-bit key generation, respectively.
Display the certificate:
x509 -noout -text -in /etc/rhsm/ca/redhat-uep.pem
Request the certificate:
req -new -key key.pem -out req.pem
- This command generates a certificate request from the private key
mykeys/key.pem and saves it into the mykeys/req.pem file.
Verify the certificate:
verify -CAfile root.pem -untrusted intermediate.pem www.example.org.pem
- You obtain the
root.pem and intermediate.pem files from the Certificate Authority (CA) with this command. Both files are placed in the keys folder.
See also
openssl man page
