How to Verify the Integrity of an SSL/TLS Certificate and Private Key Pair?

Maintaining the confidentiality of an SSL/TLS certificate together with its correlated private key is imperative for protection of Secure Socket Layer lock on the data transferred on the internet.

The SSL/TLS certificates function as a communication tool that implements secure connections between clients or between a client and server, namely web browsers and servers to assist in safeguarding from data interception, malicious manipulation and other ill-intentioned interference.

This guide shows how to verify the integrity of an ssl tls certificate and the corresponding private key in full detail and in the most simple way.

The process involves several checks: witnessing the correctness of the private key, checking the modulus of the private key and the public key, encryption/decryption to test more of the key and lastly verify files integrity using the private key.

All the above-listed steps are significant in preserving the credibility of SSL/TLS implementation.

Step Wise Process to Verify the Integrity of SSL/TLS Certificate

Step 1: Verifying the Integrity of the Private Key

The first step that is performed in this process is the checking whether the private key is intact or out guess.

At the same time, the most critical aspect of SSL/TLS certificate usage is a private key since this piece of data is responsible for decryption of messages that are encrypted with the help of the respective public key.

Whenever the private key is compromised, an attacker can be in a position to decrypt sensitive information or even imitate the server and hence lead to some severe security violations.

Using OpenSSL to Check the Private Key

OpenSSL, which is a common cryptographic library, has a relatively easy way of validating the content of a private key. The command to do this check is:

openssl rsa -in [key-file.key] -check -noout

Replace [key-file.key] with the path to your private key file.

This is an Example of a condition when a private key that does not meet the integrity:

Interpreting the Results

When you use this command, OpenSSL will scan through the private key in order to determine if its columns and rows have been modified in any way that might degrade the key’s performance.

Symmetric keys can be in the form of a letter or a number or any other figure and when the private key has been altered, it is bound to yield errors.

• RSA key error: p not prime: This indicates that one of the prime numbers used to generate the private key is not actually prime, suggesting possible tampering.
• RSA key error: n does not equal p q: This error suggests that the modulus (n) is not equal to the product of the two prime numbers (p and q), which is a critical requirement for RSA keys.
• RSA key error: d e not congruent to 1: This indicates an issue with the relationship between the private exponent (d) and the public exponent (e), which are supposed to satisfy a specific mathematical congruence.
• RSA key error: dmp1 not congruent to d: This suggests a problem with the Chinese Remainder Theorem (CRT) representation of the private key.
• RSA key error: iqmp not inverse of q: This indicates an issue with the multiplicative inverse of one of the primes, which is a key part of the CRT representation.

If any of these errors appear, it means that the private key is compromised and should not be used. In such a case, you should generate a new private key and request a new SSL/TLS certificate from your Certificate Authority (CA).

Example of a Valid Private Key

A valid private key that has not been tampered with will pass this check without errors. The output will typically include the following line:

This message confirms that the private key is structurally sound and has not been tampered with.

Once you have confirmed the integrity of the private key, you can proceed to the next step: verifying that the modulus of the private key matches the modulus of the public key in the SSL/TLS certificate.

Step 2: Confirming the Modulus Value Matching

The modulus is a critical component of the RSA encryption algorithm. In an RSA key pair, the modulus is a large number that is the product of two prime numbers. Both the private key and the public key in an RSA key pair share the same modulus.

Ensuring that the modulus of the private key matches the modulus of the public key (which is included in the SSL/TLS certificate) is essential to confirm that the two keys form a legitimate pair.

Viewing the Modulus of the SSL/TLS Certificate

To view the modulus of the public key in your SSL/TLS certificate, use the following OpenSSL command:

openssl x509 -noout -modulus -in [certificate-file.cer]

Replace [certificate-file.cer] with the path to your SSL/TLS certificate file.

Viewing the Modulus of the Private Key

Similarly, to view the modulus of the private key, use the following command:

openssl rsa -noout -modulus -in [key-file.key]

Replace [key-file.key] with the path to your private key file.

Comparing the Modulus Values

After running these commands, you will obtain the modulus values for both the SSL/TLS certificate and the private key.

These values should be identical. The modulus value is usually displayed as a large hexadecimal number. If the two values match exactly, it confirms that the private key and the public key in the SSL/TLS certificate are a valid pair.

If the modulus values do not match, this indicates a mismatch between the private key and the SSL/TLS certificate, which means the key pair is not valid for secure communication.

Example of Matching Modulus Values

Modulus (certificate): 00:af:4c:12:…:9f:2d:1f
Modulus (private key): 00:af:4c:12:…:9f:2d:1f

If the modulus values match, you can proceed to the next step. If they do not match, you will need to generate a new private key and obtain a new SSL/TLS certificate.

Step 3: Performing Encryption and Decryption Using the Key Pair

The next step in verifying the integrity of your SSL/TLS setup involves performing encryption and decryption operations using the key pair. This step tests whether the public key in the SSL/TLS certificate and the private key can work together to encrypt and decrypt data, which is the core function of SSL/TLS encryption.

Extracting the Public Key from the SSL/TLS Certificate

The first task is to extract the public key from the SSL/TLS certificate. This can be done using the following OpenSSL command:

openssl x509 -in [certificate-file.cer] -noout -pubkey > certificatefile.pub.cer

This command extracts the public key and saves it to a file named certificatefile.pub.cer.

Encrypting a Text File Using the Public Key

Next, create a small test file (e.g., test.txt) containing a simple message, such as “message test”. You will use the public key to encrypt the contents of this file. Use the following command:

openssl pkeyutl -encrypt -in test.txt -pubin -inkey certificatefile.pub.cer -out cipher.txt

This command encrypts the contents of test.txt using the public key and saves the encrypted data to a file named cipher.txt.

Decrypting the Encrypted File Using the Private Key

Now, use the private key to decrypt the contents of cipher.txt:

openssl pkeyutl -decrypt -in cipher.txt -inkey [key-file.key]

If the decryption is successful, the content displayed should match the original content of test.txt (e.g., “hello”). This confirms that the private key and the public key in the SSL/TLS certificate can correctly encrypt and decrypt data.

Example output of successful decrypted message:

This indicates that the decryption was successful and that the private key has not been compromised.

Troubleshooting Failed Decryption

If the decrypted content does not match the original content of test.txt, it suggests that the private key has been tampered with or is not correctly paired with the public key.

Also Read: Encryption Vs. Decryption: What’s the Difference?

In such cases, the private key cannot be trusted for secure communication, and you should generate a new private key and obtain a replacement SSL/TLS certificate.

Step 4: Confirming the Integrity of a Signed File

The final step in verifying the integrity of your SSL/TLS certificate and private key involves signing a file with your private key and then verifying the signature with the public key extracted from the SSL/TLS certificate. This step confirms that the private key can correctly sign data and that the signature can be verified using the corresponding public key.

Signing a File with the Private Key

First, sign the test.txt file using your private key:

openssl dgst -sha256 -sign [key-file.key] -out test.sig test.txt

This command creates a signature file named test.sig, which contains a cryptographic signature of the test.txt file.

Verifying the Signed File with the Public Key

Next, verify the signature using the public key extracted from the SSL/TLS certificate:

openssl dgst -sha256 -verify certificatefile.pub.cer -signature test.sig test.txt

Example of a Successful Verification

If the verification is successful, you will see output similar to the following:

This message indicates that the private key correctly signed the test.txt file and that the signature was successfully verified with the corresponding public key.

Troubleshooting Failed Verification

If the verification fails, you may see an error like this:

This indicates that the private key has been tampered with or is not correctly paired with the public key. In this case, you should not use the private key for secure communication, and you should generate a new private key and request a replacement SSL/TLS certificate.

Conclusion

Secure your website today with Best SSL/TLS certificates. Enjoy robust encryption, lightning-fast issuance, and unwavering trust from your visitors. Don’t leave your site vulnerable—Get started now and shield your business from cyber threats.