从pem文件生成Erlang RSA密钥

Question

我使用以下命令在Shell中生成私有RSA密钥和证书文件： openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days XXX -nodes 现在我尝试将这些文件转换为RSA公钥和私钥。我使用下面的代码但不起作用。我认为根据http://erlang.org/doc/apps/public_key/using_public_key.html，PrivateKey变量必须为#RSAPrivateKey{}，但它是#PrivateKeyInfo{}。 如何从key.pem和cert.pem生成RSA公钥和私钥？

Erlang shell:

1> {ok, PemBin} = file:read_file("key.pem").
{ok,<<"-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDMd0dnMS9t27wo\nhloldtGYbT3C/uR"...>>}
2> [RSAEntry] = public_key:pem_decode(PemBin).
[{'PrivateKeyInfo',<<48,130,4,189,2,1,0,48,13,6,9,42,134,
                     72,134,247,13,1,1,1,5,0,4,130,4,167,
                     ...>>,
                   not_encrypted}]
3> PrivateKey = public_key:pem_entry_decode(RSAEntry).
{'PrivateKeyInfo',v1,
                  {'PrivateKeyInfo_privateKeyAlgorithm',{1,2,840,113549,1,1,1},
                                                        {asn1_OPENTYPE,<<5,0>>}},
                  <<48,130,4,163,2,1,0,2,130,1,1,0,204,119,71,103,49,47,109,
                    219,188,40,134,90,37,...>>,
                  asn1_NOVALUE}
4> {ok, CertBin} = file:read_file("cert.pem").        
{ok,<<"-----BEGIN CERTIFICATE-----\nMIIDVzCCAj+gAwIBAgIJAKBDxdUZ8v9/MA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNV\nBAYTAlhYMRUwEwY"...>>}
5> [CertEntry] = public_key:pem_decode(CertBin).      
[{'Certificate',<<48,130,3,87,48,130,2,63,160,3,2,1,2,2,9,
                  0,160,67,197,213,25,242,255,127,48,13,
                  ...>>,
                not_encrypted}]
6> Cert = public_key:pem_entry_decode(CertEntry).     
{'Certificate',{'TBSCertificate',v3,11548291388562145151,
                                 {'AlgorithmIdentifier',{1,2,840,113549,1,1,11},<<5,0>>},
                                 {rdnSequence,[[{'AttributeTypeAndValue',{2,5,4,6},
                                                                         <<19,2,88,88>>}],
                                               [{'AttributeTypeAndValue',{2,5,4,7},<<"\f\fDefault City">>}],
                                               [{'AttributeTypeAndValue',{2,5,4,10},
                                                                         <<12,19,68,101,102,97,117,108,116,32,67,111,109,...>>}]]},
                                 {'Validity',{utcTime,"161226221244Z"},
                                             {utcTime,"170125221244Z"}},
                                 {rdnSequence,[[{'AttributeTypeAndValue',{2,5,4,6},
                                                                         <<19,2,88,88>>}],
                                               [{'AttributeTypeAndValue',{2,5,4,7},<<"\f\fDefault City">>}],
                                               [{'AttributeTypeAndValue',{2,5,4,10},
                                                                         <<12,19,68,101,102,97,117,108,116,32,67,...>>}]]},
                                 {'SubjectPublicKeyInfo',{'AlgorithmIdentifier',{1,2,840,
                                                                                 113549,1,1,1},
                                                                                <<5,0>>},
                                                         <<48,130,1,10,2,130,1,1,0,204,119,71,103,49,47,109,...>>},
                                 asn1_NOVALUE,asn1_NOVALUE,
                                 [{'Extension',{2,5,29,14},
                                               false,
                                               <<4,20,9,99,232,184,104,132,196,200,55,...>>},
                                  {'Extension',{2,5,29,35},
                                               false,
                                               <<48,22,128,20,9,99,232,184,104,132,...>>},
                                  {'Extension',{2,5,29,19},false,<<48,3,1,1,255>>}]},
               {'AlgorithmIdentifier',{1,2,840,113549,1,1,11},<<5,0>>},
               <<96,39,63,51,19,154,132,69,252,134,229,148,80,40,135,23,
                 44,230,150,154,106,53,135,0,68,...>>}

- Amin

---

你的 openssl 版本是多少？我测试了 0.9.8 和 1.0.2，发现由 1.0.2 生成的 pem 文件无法被 erlang 正确识别，而 0.9.8 可以。顺便说一下，我测试了两个基于 0.9.8 和 1.0.2 的 erlang 构建版本，都存在同样的问题。 - halfelf

有关 http://erlang.2086793.n4.nabble.com/public-key-amp-OpenSSL-format-weirdness-td4711182.html - Adam Millerchip

Answer 1

最终我找到了我的问题的答案。使用以下函数可以从 pem 文件中提取 私钥 和 公钥：

pubkey() ->
    File = "cert.key",
    {ok, PemBin} = file:read_file(File),
    [CertEntry] = public_key:pem_decode(PemBin),
    {_, DerCert, _} = CertEntry,
    Decoded = public_key:pkix_decode_cert(DerCert, otp),
    Decoded#'OTPCertificate'.tbsCertificate
           #'OTPTBSCertificate'.subjectPublicKeyInfo
           #'OTPSubjectPublicKeyInfo'.subjectPublicKey.


privkey() ->
    File = "pem.key",
    {ok, PemBin} = file:read_file(File),
    [RSAEntry] = public_key:pem_decode(PemBin),
    Decoded = public_key:pem_entry_decode(RSAEntry),
    Key = Decoded#'PrivateKeyInfo'.privateKey,
    public_key:der_decode('RSAPrivateKey', Key).

- Amin

---

这是硬编码 RSAPrivateKey 类型。我认为这个信息可以在 PrivateKeyInfo 数据内部获得，因此可以避免硬编码，但我不确定如何使用它。另外，我正在使用 Elixir，我不确定 Decoded#'PrivateKeyInfo'.privateKey 行是如何工作的 - 记录中没有 privateKey 字段（尽管它可以作为结构体 key = elem(decoded, 3) 的第三个元素提取出来）。 - Adam Millerchip