How do we specify the expiry date of a certificate when creating the public key via openssl command

3
votes

I am generating a private and public key using the below command.

openssl genrsa -out private.pem 2048

openssl rsa -in private.pem -outform PEM -pubout -out public.pem

But I am unable to add the expiry date here, how to add the expiry data to the public key here.

1
openssl

1 Answers

7
votes

Your getting confused between a RSA private/public key and a x509 certificate.

The RSA private/public key don't have dates in them so they don't expire. RSA Private/Public keys are used for asymmetric cryptography operations.

X509 certificates uses a private key to "sign" the certificate so that the corresponding public key can be used to verify the data in the certificate hasn't been modified.

When you create a certificate you normally create a certificate "request" that is sent to a CA to generate the certificate and sent back to you. The expire date is normally requested as a number of days in the certificate request. The CA can override this value to what if wants to allow, so you may not get the date you want but what the CA will allow you to have.

If you use openssl to generate the certificate request you use the openssl req command. You use the "-days" parameter to specify expire days from time of certificate generation.

If you just want to generate a self signed certificate, you use the openssl req command with the "-x509" parameter. Again you can use the "-days" parameter to specify expire days.