Getting an OpenSSL public key in PEM form, from a private key or a certificate.

[Robin H. Johnson]

Hi,

I'm working on a project making large use of OpenSSL to individually
encrypt items inside a database, but I've hit a stumbling block.

There appears to be absolutely no native PHP way (eg without a shell
call to openssl) to get the PEM encoded form of a public key, given
the private key and applicable passphrase.

The closest that can be gotten is a resource key, via:
$tmp = ... // PEM encoded certificate
$pubkey = openssl_pkey_get_public($tmp);
From this point however, there is still no way to get PHP to give me
the public key in a PEM encoding, for storage in the database. I've
tried all of the export functions, with various warnings returned from
them.

Getting to the above point from scratch requires generating a
certificate request from the private key, and then a self-signed
certificate from that CSR. While this is doable, leaving out the
self-signed certificate step would produce a large increase in
performance as well.

The openssl command I wish to emulate is:
openssl rsa -pubout <privkey.pem

Surely there must be a way to achieve this simple action?

[User1001]

Have you tried "openssl_pkey_export" ?
On Thu, 29 Jul 2004 19:27:04 -0700, Robin H. Johnson wrote:

I'm working on a project making large use of OpenSSL to individually
encrypt items inside a database, but I've hit a stumbling block.

There appears to be absolutely no native PHP way (eg without a shell
call to openssl) to get the PEM encoded form of a public key, given
the private key and applicable passphrase.

The closest that can be gotten is a resource key, via:
$tmp = ... // PEM encoded certificate
$pubkey = openssl_pkey_get_public($tmp);
From this point however, there is still no way to get PHP to give me
the public key in a PEM encoding, for storage in the database. I've
tried all of the export functions, with various warnings returned from
them.

Getting to the above point from scratch requires generating a
certificate request from the private key, and then a self-signed
certificate from that CSR. While this is doable, leaving out the
self-signed certificate step would produce a large increase in
performance as well.

The openssl command I wish to emulate is:
openssl rsa -pubout <privkey.pem

Surely there must be a way to achieve this simple action?

[Robin H. Johnson]

User1001 <su**********@globaleyes.net> wrote in message news:<pa****************************@globaleyes.ne t>...

Have you tried "openssl_pkey_export" ?

[snip]

the public key in a PEM encoding, for storage in the database. I've
tried all of the export functions, with various warnings returned from
them.

NONE of the export functions work to export the public key. That's
openssl_pkey_export, openssl_x509_export, openssl_csr_export.

openssl_pkey_export is the one that SHOULD work, but produces:
Warning: openssl_pkey_export(): supplied key param is a public key in
.... on line ...
Warning: openssl_pkey_export(): cannot get key from parameter 1 in ...
on line ...
and provides an empty string, returning false to show it failed.