{"id":19545741,"url":"https://github.com/ekojs/digital_signature","last_synced_at":"2026-03-06T14:30:59.704Z","repository":{"id":89321314,"uuid":"82517750","full_name":"ekojs/digital_signature","owner":"ekojs","description":"All about digital signature","archived":false,"fork":false,"pushed_at":"2024-05-25T16:09:45.000Z","size":5123,"stargazers_count":5,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-26T05:43:52.727Z","etag":null,"topics":["digital-signature","ecdsa","ecdsa-cryptography","encryption-decryption","gpg","openssl","rsa-key-pair","ssh"],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ekojs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-02-20T04:48:26.000Z","updated_at":"2024-05-25T16:09:48.000Z","dependencies_parsed_at":null,"dependency_job_id":"7c58f2e6-5289-4997-bbe4-9124f9535f74","html_url":"https://github.com/ekojs/digital_signature","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ekojs/digital_signature","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ekojs%2Fdigital_signature","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ekojs%2Fdigital_signature/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ekojs%2Fdigital_signature/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ekojs%2Fdigital_signature/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ekojs","download_url":"https://codeload.github.com/ekojs/digital_signature/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ekojs%2Fdigital_signature/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30180671,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-06T12:39:21.703Z","status":"ssl_error","status_checked_at":"2026-03-06T12:36:09.819Z","response_time":250,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["digital-signature","ecdsa","ecdsa-cryptography","encryption-decryption","gpg","openssl","rsa-key-pair","ssh"],"created_at":"2024-11-11T03:40:54.950Z","updated_at":"2026-03-06T14:30:59.669Z","avatar_url":"https://github.com/ekojs.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Digital Signature Instruction Collections\n#### Description: All about Digital Signature Instruction\n#### Author: Eko Junaidi Salam\n\n\n## Generate CA Root Key\n\n* Generate 4096bit RSA Key for Root CA\n```bash\nopenssl genrsa -aes256 -out my_ca.enc.key 4096\n```\n\n* Generate RSA Key and CSR for CA\n```bash\nopenssl req -new -newkey rsa:4096 -keyout cakey.pem -out careq.pem -config openssl.cnf\n```\n\n* Create and self-sign Root CA Certificate from RSA Key\n```bash\nopenssl req -x509 -new -nodes -key my_ca.enc.key -sha256 -days 1024 -out myCA.crt\n```\n\n* Create and self-sign V3 Root CA from CSR file\n```bash\nopenssl ca -out cacert.pem -days 2652 -keyfile cakey.pem -selfsign -config openssl.cnf -extensions v3_ca -in careq.pem\n```\n\n* Create and Sign end client CSR using Root CA from CSR file\n```bash\nopenssl ca -in serverreq.pem -days 1200 -cert cacert.pem -keyfile cakey.pem -out servercrt.pem -extensions usr_cert -config openssl.cnf\n```\n\n* Generate Certificate for client CSR using Root CA\n```bash\nopenssl x509 -req -in my_request.csr -CA myCA.crt -CAkey my_ca.enc.key -CAcreateserial -out my_request.crt -days 730 -sha256\n```\n\n* Generate PKCS12 with chain\n```bash\nopenssl pkcs12 -export -in my_request.crt -inkey my_key.enc.key -name \"Eko Junaidi Salam\" -chain -CAfile myCA.crt -out my_req_with_chain.pfx\n```\n\n* Generate PKCS12 with no chain\n```bash\nopenssl pkcs12 -export -in my_request.crt -inkey my_key.enc.key -name \"Eko Junaidi Salam\" -certfile myCA.crt -out my_req_with_chain.pfx\n```\n\n* Generate Key and self-sign Certificate\n```bash\nopenssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout my.key -out my.crt\n```\n\n* Verify end point certificate with CA\n```bash\nopenssl verify -CAfile cacert.pem servercrt.pem\n```\n\n* Revoke Certificate\n```bash\nopenssl ca -revoke tescert.crt -config openssl.cnf\n```\n\n* Generate Certificate Revocation List (CRL)\n```bash\nopenssl ca -gencrl -config openssl.cnf -out crl.pem\n```\n\n* Verify certificate based on CA and CRL\n```bash\nopenssl verify -crl_check -CAfile cacert.pem -CRLfile crl.pem servercrt.pem\n```\n\n* Verify ocsp validation\n```bash\nopenssl ocsp -CAfile cacert.pem -issuer issuer.pem -cert yourcert.crt -url http://ocsp.example.com/ -resp_text -noverify\n```\n\n## Generate RSA Key\n\n* Generate 2048bit RSA Key\n```bash\nopenssl genrsa -aes256 -out my_key.enc.key 2048\n```\n\n* Generate Public Key from RSA Key\n```bash\nopenssl rsa -in my_key.enc.key -pubout -outform pem -out my.pub.pem\n```\n\n* Generate CSR from RSA Key\n```bash\nopenssl req -new -days 730 -key my_key.enc.key -text -out my_request.csr\n```\n\n* Check CSR content from CSR file\n```bash\nopenssl req -in my_request.csr -noout -text\n```\n\n* Generate X509 default PEM Format\n```bash\nopenssl x509 -req -days 730 -in my_request.csr -signkey my_key.enc.key -out my_cert.crt\n```\n\n* Generate X509 default PEM Format using V3 Extension and SHA256 Digest\n```bash\nopenssl x509 -req -days 730 -in my_request.csr -signkey my_key.enc.key -out my_cert.crt -sha256 -extfile v3.ext\n```\n\n* Extract Public Key from X509 Certificate\n```bash\nopenssl x509 -pubkey -noout -in my_cert.crt \u003e my_pub.pem\n```\n\n* Generate SSH Public Key from RSA Key\n```bash\nssh-keygen -y -f my_key.enc.key \u003e my_ssh.pub\n```\n\n* Generate random key for encryption using aes-256-cbc\n```bash\nopenssl rand -base64 32 -out key.b64\n```\n\n* Encrypt the key using public key recipient\n```bash\nopenssl rsautl -encrypt -inkey my.pub.pem -pubin -in key.b64 -out key.b64.enc\n```\n\n* Encrypt the file using our key\n```bash\nopenssl enc -aes-256-cbc -salt -in SECRET_FILE -out SECRET_FILE.enc -pass file:./key.b64\n```\n\n* Send and Decrypt The encrypted key.b64.enc using private key recipient and your SECRET_FILE.enc using the decrypted key\n```bash\nopenssl rsautl -decrypt -inkey my_key.enc.key -in key.b64.enc -out key.b64\n\nopenssl enc -d -aes-256-cbc -in SECRET_FILE.enc -out SECRET_FILE -pass file:./key.b64\n```\n\n\n## Generate ECDSA Key\n\n* Generate Encrypted EC key\n```bash\nopenssl ecparam -genkey -name secp256k1 | openssl ec -aes256 -out my_ec.enc.key\n```\n\n* Generate Public Key from EC Key\n```bash\nopenssl ec -in my_ec.enc.key -pubout -out my_ecpub.pem\n```\n\n* Generate CSR from EC Key\n```bash\nopenssl req -new -sha256 -key my_ec.enc.key -days 730 -text -out my_ec.csr\n```\n\n* Generate derive key as shared secret from recipient EC Public Key\n```bash\nopenssl pkeyutl -derive -inkey my_ec.enc.key -peerkey bob_ecpub.pem | openssl dgst -sha256 -r | sed 's/ \\*stdin//g' \u003e pass.hash\n```\n\n* Encrypt data using shared secret from derive key\n```bash\nopenssl enc -aes256 -base64 -k pass.hash -e -in hello.txt -out hello.txt.enc\n```\n\n* Decrypt data using shared secret from derive key\n```bash\nopenssl enc -aes256 -base64 -k pass.hash -d -in hello.txt.enc -out hello.txt\n```\n\n\n## Asymmetric Key Operation in Kernel Keyring\n```bash\ndnf install -y keyutils\nmodprobe pkcs8_key_parser\n```\n\n* Create keyring in user space and generate key\n```bash\nkeyctl newring myring @u\nopenssl genrsa -out my.key 4096\nopenssl rsa -in my.key -pubout -out my.pub\nopenssl pkcs8 -outform der -topk8 -in my.key -out my.p8 -nocrypt\n```\n\n* Add Private Key type asymmetric using pkcs8 unencrypted format\n```bash\ncat my.p8 | keyctl padd asymmetric mykey %keyring:myring\n```\n\n* Encrypt data using enc pkcs1\n```bash\nkeyctl pkey_encrypt %asymmetric:mykey 0 hello.txt enc=pkcs1 hash=sha256 \u003e hello.enc\n```\n\n* Decrypt data using enc pkcs1\n```bash\nkeyctl pkey_decrypt %asymmetric:mykey 0 hello.enc enc=pkcs1\n```\n\n* Signing data\n```bash\ncat hello.txt | openssl sha256 -binary -out hello.hash\nkeyctl pkey_sign %asymmetric:mykey 0 hello.hash enc=pkcs1 hash=sha256 \u003e hello.sig\n```\n\n* Verify data\n```bash\ncat hello.txt | openssl sha256 -verify my.pub -signature hello.sig\n```\n\n\n## My Certificate OpenSSH\n* Create SSH Public Key from OpenSSL Key\n```bash\nssh-keygen -y -f my_key.enc.key \u003e my-ssh.pub\n```\n\n* Show Fingerprint of SSH Public Key\n```bash\nssh-keygen -lv -E md5 -f my_ssh.pub\n```\n\n* Generate Certificate SSH\n```bash\n# Add config sshd\n# TrustedUserCAKeys /etc/ssh/keys/ca.pub\n# RevokedKeys /etc/ssh/keys/revoked.txt\n\nssh-keygen -I \"Identity name xxx\" -s ca.key -n username -V +1d username.pub\n```\n\n* Print Certificate Information\n```bash\nssh-keygen -L -f username-cert.pub\n```\n\n* Generate Revoked Key File\n```bash\nssh-keygen -k -f revoked.txt\n```\n\n* Revoked SSH Keys\n```bash\nssh-keygen -k -f revoked.txt -u username.pub\n```\n\n* Print Revoked SSH Keys\n```bash\nssh-keygen -Q -l -f revoked.txt\n```\n\n\n## My Certificate X509\n\n* Generate CSR from Certificate\n```bash\nopenssl x509 -x509toreq -in .\\my_cert.crt -signkey .\\my_key.enc.key -out .\\my_request.csr\n```\n\n* Renew expired certificate\n```bash\nopenssl x509 -req -days 365 -in .\\my_request.csr -signkey .\\my_key.enc.key -out .\\my_cert_renew.crt\n```\n\n* Get unencrypted key from encrypted private key\n```bash\nopenssl rsa -in .\\my_key.enc.key -out hasil.key\n```\n\n* Generate PKCS12 from Certificate\n```bash\nopenssl pkcs12 -export -in .\\my_cert_renew.crt -inkey .\\my_key.enc.key -out .\\my_cert_renew.p12\n ```\n\n* Extract Private Key (PEM) from PKCS12\n```bash\nopenssl pkcs12 -in .\\my_cert_renew.p12 -nocerts -out .\\my_cert.pem\n```\n\n* Extract Private Key from PEM file using DES3 encrypted\n```bash\nopenssl rsa -in .\\my_cert.pem -des3 -out .\\my_key.enc.key\n```\n\n* Extract Client Certificate from PKCS12\n```bash\nopenssl pkcs12 -in .\\my_cert_renew.p12 -nokeys -clcerts -out .\\my_cert.crt\n```\n\n* Extract CA Certificate from PKCS12\n```bash\nopenssl pkcs12 -in .\\my_cert_renew.p12 -nokeys -cacerts -out .\\my_cert.crt\n```\n\n* Create Public Key from RSA Private Key\n```bash\nopenssl rsa -in .\\my_key.enc.key -pubout -out my_key.pub\n```\n\n* Sign a digest with RSA Private Key\n```bash\nopenssl dgst -sha256 -sign .\\my_key.enc.key -out .\\README.md.sig .\\README.md\n```\n\n* Verify a Signed Digest using Public Key\n```bash\nopenssl dgst -sha256 -verify .\\my_key.pub -signature .\\README.md.sig .\\README.md\n```\n\n* Sign/Verify data using X509 with RSA-PSS mode\n```bash\n# Create digest from the message\nopenssl dgst -sha256 -binary -out msg.bin msg.txt\n# Create signed message using private key\nopenssl pkeyutl -sign -inkey me.key -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pss -pkeyopt rsa_mgf1_md:sha256 -pkeyopt rsa_pss_saltlen:digest -out msg.sig -in msg.bin\n# Verified signed message using X509 Certificate\nopenssl pkeyutl -verify -inkey me.crt -certin -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pss -pkeyopt rsa_mgf1_md:sha256 -sigfile msg.sig -in msg.bin\n```\n\n* Encrypt/Decrypt data using X509 with RSA-OAEP\n```bash\n# Encrypt using X509\nopenssl pkeyutl -encrypt -inkey me.crt -certin -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha256 -out msg.enc -in msg.txt\n# Decrypt using Private Key\nopenssl pkeyutl -decrypt -inkey me.key -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha256 -out msg.dec -in msg.enc\n```\n\n* Encrypt/Decrypt data using X509 with RSA-OAEP and piv pkcs11\n```bash\n# Compile libp11 library to get pkcs11.dll/so file from this github link\n# https://github.com/OpenSC/libp11.git\n\n# Set the OPENSSL_CONF to engine.cnf\n# https://raw.githubusercontent.com/ekojs/digital_signature/master/engine.cnf\n\n# Check pkcs11 engine in openssl\nopenssl engine pkcs11 -c\n# Your output if it's available :\n# (pkcs11) pkcs11 engine\n#  [RSA, rsaEncryption, id-ecPublicKey]\n\n# Encrypt\nopenssl pkeyutl -encrypt -engine pkcs11 -keyform engine -inkey 3 -passin file:pin.piv -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha256 -in msg.txt -out msg.enc\n# Decrypt\nopenssl pkeyutl -decrypt -engine pkcs11 -keyform engine -inkey 3 -passin file:pin.piv -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha256 -in msg.enc -out msg.dec\n```\n\n* AES-KWP as RFC 5649 compliant Using patched openssl-1.1.0l or openssl-3.0.x latest release\n```bash\n# The -id-aes256-wrap-pad cipher is the RFC 3394 compliant wrapping mechanism that coincides with CKM_RSA_AES_KEY_WRAP. The -iv values are set by RFC 5649 (an extension to RFC 3394)\n# see rfc 5649 https://tools.ietf.org/html/rfc5649\nopenssl rand -out rand.bin 32\nopenssl enc -id-aes256-wrap-pad -iv A65959A6 -K $(hexdump -v -e '/1 \"%02x\"' \u003c rand.bin) -in my.p8 -out wrap.bin\n```\n\n* Unwrap data using AES-KWP RFC 5649\n```bash\nopenssl enc -d -id-aes256-wrap-pad -iv A65959A6 -K $(hexdump -v -e '/1 \"%02x\"' \u003c rand.bin) -in wrap.bin -out my.p8.der\n```\n\n\n## My Certificate gpg (GnuPG) 1.4.20\n```bash\nSupported algorithms:\nPubkey: RSA, RSA-E, RSA-S, ELG-E, DSA\nCipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,\n        CAMELLIA128, CAMELLIA192, CAMELLIA256\nHash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224\nCompression: Uncompressed, ZIP, ZLIB, BZIP2\nRead : https://futureboy.us/pgp.html\n```\n\n* Generate GPG Public \u0026 Private Key\n```bash\ngpg -i --gen-key\n```\n\n* Change key\n```bash\ngpg -i -edit-key user_id\n```\n\n* Change cipher algorithms\n```bash\ngpg --cipher-algo name -ca your_file\n```\n\n* Using Stronger Algorithms\n```bash\ngpg -i --edit-key user_id \nhelp\nshowpref\nsetpref AES256 CAMELLIA256 AES192 CAMELLIA192 AES CAMELLIA128 TWOFISH CAST5 3DES SHA512 SHA384 SHA256 SHA224 SHA1 RIPEMD160 ZLIB BZIP2 ZIP Uncompressed\nsave\n```\n\n* Backup Secret Key and Subkey\n```bash\ngpg --export-secret-key -a -o key.asc\ngpg --export-secret-subkeys -a -o subkey.asc\n```\n\n* Backup Public Key\n```bash\ngpg -o pub.gpg -a --export eko_junaidisalam@live.com\n```\n\n* Encrypt using symmetric cipher\n```bash\ngpg --cipher-algo aes256 -ca filename\n```\n\n* Decrypt a file\n```bash\ngpg filename\n```\n\n* Sign and armored a file\n```bash\ngpg -o hasil.asc -sa filename\n```\n\n* Verify a signed armored file\n```bash\ngpg --verify hasil.asc\n```\n\n* Create revocation certificate\n```bash\ngpg -o my_revocation_cert --gen-revoke key_id\n```\n\n* Separate Master Keypair to Laptop Keypair\n```bash\nmkdir /tmp/gpg\nsudo mount -t tmpfs -o size=1M tmpfs /tmp/gpg\ngpg --export-secret-subkeys key_id \u003e /tmp/gpg/subkeys\ngpg --delete-secret-key key_id\ngpg --import /tmp/gpg/subkeys\nsudo umount /tmp/gpg\nrm -rf /tmp/gpg\n\ngpg -K\n\n# You should see like this 'sec#  2048R/C774674E 2016-03-10' not 'sec  2048R/C774674E 2016-03-10', it means you're successfully separate subkey from the keypair located in your keyring.\n```\n\n* Show photo in gpg\n```bash\n# You must set photo-viewer \"eog %i\" in your gpg.conf file\n\ngpg --list-options show-photos --fingerprint ekojs\n```\n\n* Sign someone key\n```bash\ngpg -u yourkey --sign-key --ask-cert-level someone@email.com\n```\n\n\n## Check corresponding RSA Private Key \u0026 Public Key\n* For RSA \u0026 X509\n```bash\nopenssl rsa -in .\\my_key.enc.key -modulus -noout | openssl md5\nopenssl x509 -in .\\my_cert.crt -modulus -noout | openssl md5\n```\n\n* For RSA \u0026 SSH Pub Key\n```bash\nssh-keygen -y -f my_key.enc.key\ncat my_ssh.pub\n```\n\n* Check pub fingerprint\n```bash\nssh-keygen -lv -E md5 -f my_ssh.pub\nopenssl x509 -noout -fingerprint -md5 -in .\\my_cert.crt\n```\n\n* For Pub \u0026 priv Key OpenPGP, you can check it in `keyid` values.\n```bash\ngpg --list-packets pub_key.asc | head\ngpg --list-packets priv_key.asc | head\n```\n\n## Check IMAP via SSL uses port 993\n```\nopenssl s_client -showcerts -connect mail.example.com:993\n```\n\n## Check POP3 via SSL uses port 995\n```\nopenssl s_client -showcerts -connect mail.example.com:995\n```\n\n## Check SMTP via SSL uses port 465\n```\nopenssl s_client -showcerts -connect mail.example.com:465\n```\n\n## Check SMTP via TLS/StartTLS uses port 587\n```\nopenssl s_client -starttls smtp -showcerts -connect mail.example.com:587\n```\n\n## Configure OCSP Stapling\n#### some reading : [Configure OCSP Stapling](https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx)\n* Retrieve CA Bundle\n```bash\nwget -O - https://www.digicert.com/CACerts/DigiCertHighAssuranceEVRootCA.crt | openssl x509 -inform DER -outform PEM | tee -a ca-certs.pem\u003e /dev/null\nwget -O - https://www.digicert.com/CACerts/DigiCertHighAssuranceEVCA-1.crt | openssl x509 -inform DER -outform PEM | tee -a ca-certs.pem\u003e /dev/null\n```\n* Config OCSP\n```bash\n# Outside vhost\nSSLStaplingCache shmcb:/tmp/stapling_cache(128000)\n\n# Inside vhost\nSSLCACertificateFile /etc/ssl/ca-certs.pem\nSSLUseStapling on\n\n# Check\napachectl configtest\n```\n* Testing OCSP Stapling\n```\necho QUIT | openssl s_client -connect ocsp.digicert.com:443 -status 2\u003e /dev/null | grep -A 17 'OCSP response:' | grep -B 17 'Next Update'\n```\n\n## Create certificate using lets encrypt\n#### some reading : [Generate wildcard ssl using lets encrypt](https://medium.com/@saurabh6790/generate-wildcard-ssl-certificate-using-lets-encrypt-certbot-273e432794d7)\n```bash\napt install letsencrypt\ncertbot certonly --manual --preferred-challenges=dns --email your-email@gmail.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d *.example.com\n```\n\n\n## Generate Certificate using Keytool from Java\n* Create self-sign Certificate\n```bash\nkeytool -genkeypair -storepass 123456 -storetype pkcs12 -alias test -validity 365 -v -keyalg RSA -keysize 2048 -keystore keystore.p12 \n```\n\n* Check detail keystore content\n```bash\nkeytool -keystore keystore.p12 -list -v\n```\n\n* Import another PKCS12 to keystore\n```bash\nkeytool -importkeystore -srcstoretype pkcs12 -srckeystore cert.p12 -destkeystore keystore.p12 -srcalias 1 -destalias youralias\n```\n\n\n## Using Free Time Stamp Authority\n#### Source from [Free TSA](https://freetsa.org/)\n\n* Download CA and tsa cert\n```bash\nwget https://freetsa.org/files/tsa.crt\nwget https://freetsa.org/files/cacert.pem\n```\n\n* Create a tsq (TimeStampRequest) file, which contains a hash of the file you want to sign.\n```bash\nopenssl ts -query -data signed.pdf -no_nonce -sha512 -cert -out signed.tsq\n```\n\n* Send the TimeStampRequest to freeTSA.org and receive a tsr (TimeStampResponse) file. \n```bash\ncurl -H \"Content-Type: application/timestamp-query\" --data-binary '@signed.tsq' https://freetsa.org/tsr \u003e signed.tsr\n```\n\n* With the public Certificates you can verify the TimeStampRequest. \n```bash\nopenssl ts -verify -in signed.tsr -queryfile signed.tsq -CAfile cacert.pem -untrusted tsa.crt\n```\n\n* URL Screenshooter from TSA\n```bash\ncurl --data \"screenshot=https://www.fsf.org/\u0026delay=n\" https://freetsa.org/screenshot.php \u003e screenshot.pdf\n```\n\n\n## Create Perfect Keypair in OpenPGP\n* Generate key RSA-RSA 4096 bits keysize\n* Add photo to the key\n* Add subkey to complete flag i.e : SC, S, E\n* Use Stronger Algorithms\n* Creating Revocation Certificate if your master keypair gets lost or stolen. This file is only way to tell everyone to ignore the stolen key.\n* Separate Master keypair to laptop keypair\n\n\n#### Passphrase for all key is `12345`\n\n\n#### Note:\nPlease feel free to add useful instruction to this repo. Silahkan bebas untuk menambahkan perintah-perintah yang berguna dalam Digital Signature pada repo ini.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fekojs%2Fdigital_signature","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fekojs%2Fdigital_signature","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fekojs%2Fdigital_signature/lists"}