Extracting and Securing PEM Files.md

Extracting and Securing PEM Files

When working with PEM files that contain both a certificate and a private key, you often need to split them and optionally protect the key with a password.

---

1. Split Certificate and Private Key

• Extract the certificate:

  openssl x509 -in server.pem -out cert.pem

• Extract the private key:

  openssl pkey -in server.pem -out key.pem

---

2. Add Password Protection to the Private Key

To encrypt the key with a password:

openssl pkey -in key.pem -out key_enc.pem -aes256

• -aes256 specifies AES-256 encryption (other options: -aes128, -des3).
• You’ll be prompted to set a passphrase.

---

3. Verify

• Check the certificate:

  openssl x509 -in cert.pem -text -noout

• Check the encrypted key (password will be required):

  openssl pkey -in key_enc.pem -text -noout

---

4. Notes

• Always secure the private key (chmod 600 key.pem).
• Do not forget the passphrase; losing it makes the key unusable.
• Be mindful: password-protected keys require manual input at each use, which may complicate automated setups.