0

I am the developer of a WebExtension for Chrome. The WebExtension is not listed in the Chrome Web Store because it is only used for internal purposes.

When packaging the first version of the WebExtension I got a pem file which contains a private key. Currently, I am using chrome.exe to create/sign new releases of my WebExtension using my private key.

I have noticed that the file is not protected by a passphrase and contains the private key in plaintext. I think it is handled that way to simplify the packaging process for developers. However, I am concerned about the security of my private key. Therefore, I want to protect my private key with a passphrase.

I guess that chrome.exe will expect a pem file containing a plaintext private key so I have searched for alternatives to sign my WebExtension and found the following:

Both of them using openssl. Hence, handling of an encrypted private key can be added but I am not very experienced using openssl.

Do common/best practice openssl commands exists for encrypting and decrypting a pem file?

Any help will be appreciated, thanks!

Ronquam
  • 145
  • 2
  • 13

1 Answers1

0

Encrypt a key with a passphrase:

$ openssl rsa -in a.pem -aes256 -out a.key
writing RSA key
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

Decrypting a key with a passphrase:

$ openssl rsa -in a.key | openssl pkcs8 -topk8 -nocrypt -out a.pem
Enter pass phrase for a.key:
writing RSA key

The shell commands openssl sha1 -sign -key a.key and openssl rsa -in a.key will prompt for the pass phrase as necessary, so you would only need to explicitly decrypt the key if you wanted to use it in Chrome's UI, which just can't handle an encrypted PEM.

Josh Lee
  • 171,072
  • 38
  • 269
  • 275
  • 1
    The resulting file after decryption (a.pem) differs from my original private key because it is PKCS#1 encoded. The private key you get from Chrome is PKCS#8 encoded. Chrome does not support PKCS#1 format. If I try to use it the following error message is displayed: `Input value for private key must be a valid format (PKCS#8-format PEM-encoded RSA key).` The following command converts PKCS#1 to PKCS#8 (https://stackoverflow.com/questions/8290435): `openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in pkcs1.pem -out pkcs8.pem` – Ronquam Sep 17 '18 at 14:30
  • Thanks! I overlooked that. – Josh Lee Sep 17 '18 at 15:05