Getting an OpenSSL public key in PEM form, from a private key or a certificate.

[Robin H. Johnson]

Hi,

I'm working on a project making large use of OpenSSL to individually
encrypt items inside a database, but I've hit a stumbling block.

There appears to be absolutely no native PHP way (eg without a shell
call to openssl) to get the PEM encoded form of a public key, given
the private key and applicable passphrase.

The closest that can be gotten is a resource key, via:
$tmp = ... // PEM encoded certificate
$pubkey = openssl_pkey_ge t_public($tmp);
From this point however, there is still no way to get PHP to give me
the public key in a PEM encoding, for storage in the database. I've
tried all of the export functions, with various warnings returned from
them.

Getting to the above point from scratch requires generating a
certificate request from the private key, and then a self-signed
certificate from that CSR. While this is doable, leaving out the
self-signed certificate step would produce a large increase in
performance as well.

The openssl command I wish to emulate is:
openssl rsa -pubout <privkey.pem

Surely there must be a way to achieve this simple action?

[User1001]

Have you tried "openssl_pkey_e xport" ?
On Thu, 29 Jul 2004 19:27:04 -0700, Robin H. Johnson wrote:

I'm working on a project making large use of OpenSSL to individually
encrypt items inside a database, but I've hit a stumbling block.

There appears to be absolutely no native PHP way (eg without a shell
call to openssl) to get the PEM encoded form of a public key, given
the private key and applicable passphrase.

The closest that can be gotten is a resource key, via:
$tmp = ... // PEM encoded certificate
$pubkey = openssl_pkey_ge t_public($tmp);
From this point however, there is still no way to get PHP to give me
the public key in a PEM encoding, for storage in the database. I've
tried all of the export functions, with various warnings returned from
them.

Getting to the above point from scratch requires generating a
certificate request from the private key, and then a self-signed
certificate from that CSR. While this is doable, leaving out the
self-signed certificate step would produce a large increase in
performance as well.

The openssl command I wish to emulate is:
openssl rsa -pubout <privkey.pem

Surely there must be a way to achieve this simple action?

[Robin H. Johnson]

User1001 <su**********@g lobaleyes.net> wrote in message news:<pa******* *************** ******@globaley es.net>...

Have you tried "openssl_pkey_e xport" ?

[snip]

the public key in a PEM encoding, for storage in the database. I've
tried all of the export functions, with various warnings returned from
them.

NONE of the export functions work to export the public key. That's
openssl_pkey_ex port, openssl_x509_ex port, openssl_csr_exp ort.

openssl_pkey_ex port is the one that SHOULD work, but produces:
Warning: openssl_pkey_ex port(): supplied key param is a public key in
.... on line ...
Warning: openssl_pkey_ex port(): cannot get key from parameter 1 in ...
on line ...
and provides an empty string, returning false to show it failed.