Inspecting Certificate Information (2/2) - Encryption Verification

Hands-on practice verifying encryption using the public key of the Root CA certificate.

Encryption Verification Overview

Using the Root CA certificate, you will verify the core principle of asymmetric-key cryptography: ’encrypt with the public key, decrypt with the private key’.

1. Lab Flow Diagram

    sequenceDiagram
    participant P as Plaintext (hello.txt)
    participant K as Root CA public key (ca.pub)
    participant E as Ciphertext (hello.enc)
    participant SK as Root CA private key (ca.key)

    Note over P,K: 1. Encrypt with the public key
    P->>K: Pass plaintext
    K-->>E: Create encrypted file
    
    Note over E,SK: 2. Decrypt with the private key
    E->>SK: Pass ciphertext
    SK-->>P: Restore original plaintext
  

2. Key Commands Summary

Extract the Public Key

Extract only the public key portion to be used for encryption from the certificate file (.crt).

openssl x509 -in /etc/kubernetes/pki/ca.crt -pubkey -noout > ca.pub

Encrypt a File

Use the extracted public key to convert a plain text file into encrypted binary data.

openssl pkeyutl -encrypt -pubin -inkey ca.pub -in hello.txt -out hello.enc

Decrypt a File

Restore the encrypted file back to readable text using only the matching private key.

openssl pkeyutl -decrypt -inkey /etc/kubernetes/pki/ca.key -in hello.enc -out hello.dec

3. Analyzing the Results

• Encryption succeeded: Running cat hello.enc prints garbled, unreadable characters.
• Decryption succeeded: Running cat hello.dec correctly prints the original “Hello World”.
• Conclusion: We confirmed that although anyone can hold a public key, data encrypted with it can be read only by the party that owns the private key.

This principle is the foundation of the communication security by which every Kubernetes component exchanges data safely with the API server.