Sign and verify a file using OpenSSL command line tool. It exports the digital signature in Base64 format.

sign.sh

#!/bin/bash
# Sign a file with a private key using OpenSSL
# Encode the signature in Base64 format
#
# Usage: sign <file> <private_key>
#
# NOTE: to generate a public/private key use the following commands:
#
# openssl genrsa -aes128 -passout pass:<passphrase> -out private.pem 2048
# openssl rsa -in private.pem -passin pass:<passphrase> -pubout -out public.pem
#
# where <passphrase> is the passphrase to be used.

filename=$1
privatekey=$2

if [[ $# -lt 2 ]] ; then
  echo "Usage: sign <file> <private_key>"
  exit 1
fi

openssl dgst -sha256 -sign $privatekey -out /tmp/$filename.sha256 $filename
openssl base64 -in /tmp/$filename.sha256 -out signature.sha256
rm /tmp/$filename.sha256

verify.sh

#!/bin/bash
# Verify a file with a public key using OpenSSL
# Decode the signature from Base64 format
#
# Usage: verify <file> <signature> <public_key>
#
# NOTE: to generate a public/private key use the following commands:
#
# openssl genrsa -aes128 -passout pass:<passphrase> -out private.pem 2048
# openssl rsa -in private.pem -passin pass:<passphrase> -pubout -out public.pem
#
# where <passphrase> is the passphrase to be used.

filename=$1
signature=$2
publickey=$3

if [[ $# -lt 3 ]] ; then
  echo "Usage: verify <file> <signature> <public_key>"
  exit 1
fi

openssl base64 -d -in $signature -out /tmp/$filename.sha256
openssl dgst -sha256 -verify $publickey -signature /tmp/$filename.sha256 $filename
rm /tmp/$filename.sha256

@ pshterev

x509 -in -pubkey -noout > public_key.pem

I did find this command example often in internet, but for my openssl version coming along with git this does not work, i get error x509: Unknown parameter >. But I can use just "-noout" to get a print in the console, or "-out public_key.pem" to get a file.

parameter >

Do you use bash ? cmd.exe ? or an exotic shell. cmd.exe and posix shell should support redirection to file (and doesn't interpret > as parameter). If you have a posix shell check the content of the variable IFS (it should contain at least space).

Here is a very nice blog: https://pagefault.blog/2019/04/22/how-to-sign-and-verify-using-openssl/.

See also official page: https://docs.openssl.org/3.1/man1/openssl-dgst/