"OpenSSL" Generating Certificates in DER and PEM

Cryptography Tutorials - Herong's Tutorial Examples

∟Certificate X.509 Standard and DER/PEM Formats

∟"OpenSSL" Generating Certificates in DER and PEM

This section provides a tutorial example on how to generate certificates in DER and PEM formats using 'OpenSSL'.

After tested how "keytool" can be used to export certificates in DER and PEM formats, I decided to try with "OpenSSL" to see if it can generate certificates in DER and PEM formats or not. What I did was to:

Run "openssl genrsa" to generate a RSA key pair.
Run "openssl req -new -x509" to generate a self-signed certificate and stored it in PEM format.
Run "openssl x509" to convert the certificate from PEM encoding to DER format.

The test session was recorded below:

herong> openssl genrsa -out herong.key -des 1024

Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
.........................++++++
...................++++++
e is 65537 (0x10001)
Enter pass phrase for herong.key: keypass
Verifying - Enter pass phrase for herong.key: keypass

herong> openssl req -new -x509 -key herong.key -out openssl_crt.pem \
   -outform pem -config openssl.cnf

Enter pass phrase for herong.key: keypass
You are about to be asked to enter information that will be 
incorporated into your certificate request.
What you are about to enter is what is called a Distinguished 
Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CA]:
State or Province Name (full name) [HY State]:
Locality Name (eg, city) [HY City]:
Organization Name (eg, company) [HY Company]:
Organizational Unit Name (eg, section) [HY Unit]:
Common Name (eg, YOUR name) [Herong Yang]:
Email Address [herongyang.com]:

herong> openssl x509 -in openssl_crt.pem -inform pem \
   -out openssl_crt.der -outform der

Now I got one certificate generated by "OpenSSL" and stored in two files: openssl_crt.der and openssl_crt.pem. How can I verify that they are really using DER and PEM formats? I used "keytool" to try to view them as described in the next section.