Appending a pem to another

Question

I found a blog that helped me relay postfix through smtp.gmail.com with SASL authentication. One of the steps was:

cat /etc/ssl/certs/Thawte_Premium_Server_CA.pem | \
              sudo tee -a /etc/postfix/smtp_cacert.pem

When I read something like this, I get a little concerned, because I'm not entirely sure what happens if I append the Thawte .pem to mine. I built the .pem with:

openssl req -new -x509 -days 365 -nodes -out smtp_cacert.pem \
             -keyout smtp_cacert.key`...

What is the risk of appending the Thawte .pem on the one I generated?
What functionally is this doing to SSL when I append the Thawte .pem to mine?

score 5 · Accepted Answer · answered Aug 03 '13 at 18:27

The correct order for combining multiple PEM files is:

the correct PEM order is as follows:

-----BEGIN RSA PRIVATE KEY-----
(Your Private Key: your_domain_name.key)
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
(Your Primary SSL certificate: your_domain_name.crt)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Intermediate certificate: IntermediaryCA.crt)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Root certificate: TrustedRoot.crt)
-----END CERTIFICATE-----

Any of them you don't have (or don't want to be contained in one file) can be omitted. But the order goes from most specific to least specific.

Key
Your cert
Intermediary CA cert
Root CA cert

If there are multiple intermediaries just keep listing them in order, in the same order as the chain.

Not all programs require this order, some will figure it out on their own. But I've experienced both Postfix and stunnel require this order.

score 2 · Answer 2 · answered Aug 04 '13 at 01:47

2

What is the risk of appending the Thawte .pem on the one I generated?

None.

What functionally is this doing to SSL when I append the Thawte .pem to mine?

Placing multiple items in the same file makes them all available to the SSL library for initiating connections. Specifically, if one or more certificates signed the certificate that corresponds to the private key you're using, then those additional (typically "intermediate") certificates will be sent to the connecting client to aid in establishing a chain of trust from some trusted root installed on the client's computer and the certificate you're using to secure your session.

Like this:

[ Trusted root ] --signed--> [ Intermediate ] --signed--> [ Your Cert ]

If the client doesn't have a copy of the intermediate certificate, he can't make the link between the trusted root and your cert. If you provide it during SSL negotiation then he won't need to have already received a copy.

answered Aug 04 '13 at 01:47

tylerl

2,438
15
18

Thank you for answering the questions I asked. My certificate was self-signed. Under this circumstance, why should I append the Thawte cert to it? Thawte should not need to be anywhere in the certificate chain, right? – Mike Pennington Aug 04 '13 at 06:35
If your cert is *self signed*, I don't see the thawte certificate being particularly relevant. Why do you even have it? – tylerl Aug 04 '13 at 06:57
That's part of my question... It didn't seem like it needs to be in my `.pem`. The blogger had it appended to `/etc/postfix/cacert.pem`, but I didn't know where that came from so I built my own `.pem`. Thanks for helping me understand the bigger picture. I'm going to accept this answer. – Mike Pennington Aug 04 '13 at 07:06

score 1 · Answer 3 · edited Apr 13 '17 at 12:13

All you're doing is creating a chain of certificates when you concatenate them together like this. This SO Q&A explains the formats of the various files, titled: What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?. It's probably the best explanation of the different file formats I've seen.

excerpt

.pem Defined in RFC's 1421 through 1424, this is a container format that may include just the public certificate (such as with Apache installs, and CA certificate files /etc/ssl/certs), or may include an entire certificate chain including public key, private key, and root certificates. The name is from Privacy Enhanced Email, a failed method for secure email but the container format it used lives on.

Appending a pem to another

3 Answers3