OpenSSL Commands

OpenSSL commands for certificates, keys, and encryption.

Certificate Generation

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

Generate self-signed certificate

openssl req -new -key private.key -out request.csr

Generate certificate signing request (CSR)

openssl req -newkey rsa:2048 -nodes -keyout key.pem -out request.csr

Generate CSR with new private key

openssl x509 -req -in request.csr -signkey private.key -out cert.pem

Sign CSR with private key

openssl genrsa -out private.key 4096

Generate 4096-bit RSA private key

openssl genrsa -aes256 -out private.key 4096

Generate encrypted RSA private key

Certificate Viewing

openssl x509 -in cert.pem -text -noout

View certificate details

openssl x509 -in cert.pem -noout -dates

Show certificate validity dates

openssl x509 -in cert.pem -noout -subject

Show certificate subject

openssl x509 -in cert.pem -noout -issuer

Show certificate issuer

openssl x509 -in cert.pem -noout -fingerprint

Show certificate fingerprint

openssl req -in request.csr -text -noout

View CSR details

openssl rsa -in private.key -text -noout

View private key details

Certificate Conversion

openssl x509 -in cert.pem -outform DER -out cert.der

Convert PEM to DER format

openssl x509 -in cert.der -inform DER -out cert.pem

Convert DER to PEM format

openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem

Convert PEM to PKCS12/PFX

openssl pkcs12 -in cert.pfx -out cert.pem -nodes

Convert PKCS12 to PEM

openssl rsa -in key.pem -outform DER -out key.der

Convert private key to DER

Key Operations

openssl rsa -in private.key -pubout -out public.key

Extract public key from private key

openssl rsa -in encrypted.key -out decrypted.key

Remove passphrase from private key

openssl rsa -aes256 -in key.pem -out encrypted.key

Add passphrase to private key

openssl rsa -in key.pem -check

Verify private key consistency

openssl ec -in ec_key.pem -text -noout

View EC private key

openssl ecparam -genkey -name secp384r1 -out ec_key.pem

Generate EC private key

SSL/TLS Testing

openssl s_client -connect host:443

Test SSL/TLS connection

openssl s_client -connect host:443 -showcerts

Show server certificate chain

openssl s_client -connect host:443 -servername hostname

Test with SNI (Server Name Indication)

openssl s_client -connect host:443 -tls1_2

Force TLS 1.2

openssl s_client -connect host:443 -cipher "ECDHE-RSA-AES128-GCM-SHA256"

Test specific cipher

echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -dates

Quick certificate expiry check

Hashing & Digests

openssl dgst -sha256 file.txt

Calculate SHA-256 hash of file

openssl dgst -md5 file.txt

Calculate MD5 hash of file

openssl dgst -sha1 file.txt

Calculate SHA-1 hash of file

openssl dgst -sha256 -sign private.key -out signature.bin file.txt

Sign file with private key

openssl dgst -sha256 -verify public.key -signature signature.bin file.txt

Verify signature with public key

Encryption & Decryption

openssl enc -aes-256-cbc -salt -in file.txt -out file.enc

Encrypt file with AES-256

openssl enc -aes-256-cbc -d -in file.enc -out file.txt

Decrypt AES-256 encrypted file

openssl rsautl -encrypt -pubin -inkey public.key -in file.txt -out file.enc

Encrypt with RSA public key

openssl rsautl -decrypt -inkey private.key -in file.enc -out file.txt

Decrypt with RSA private key

openssl enc -base64 -in file.txt -out file.b64

Base64 encode file

openssl enc -base64 -d -in file.b64 -out file.txt

Base64 decode file

Certificate Verification

openssl verify cert.pem

Verify certificate against trusted CAs

openssl verify -CAfile ca.pem cert.pem

Verify certificate against specific CA

openssl x509 -in cert.pem -noout -checkend 86400

Check if cert expires within 24 hours

openssl rsa -in private.key -check

Verify private key

openssl x509 -noout -modulus -in cert.pem | openssl md5

Get certificate modulus hash

openssl rsa -noout -modulus -in key.pem | openssl md5

Get private key modulus hash

Advanced Operations

openssl rand -hex 32

Generate 32-byte random hex string

openssl rand -base64 32

Generate 32-byte random base64 string

openssl passwd -1 "password"

Generate MD5 password hash

openssl speed rsa2048

Benchmark RSA 2048 performance

openssl ciphers -v

List all available ciphers

openssl version -a

Show detailed OpenSSL version info