🔐
OpenSSL cheat sheet
OpenSSL commands for generating keys, creating certificates, inspecting them and testing TLS connections. Keep private keys secret and never share a .key file.
Click any command to copy it.
Generate keys and requests
| Command | What it does |
|---|---|
openssl genrsa -out key.pem 4096 | Generate a 4096-bit RSA private key. |
openssl genpkey -algorithm ed25519 -out key.pem | Generate an Ed25519 private key. |
openssl req -new -key key.pem -out request.csr | Create a certificate signing request (CSR). |
openssl req -x509 -newkey rsa:4096 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=example.com" | Create a self-signed certificate valid for a year (no passphrase). |
openssl req -in request.csr -noout -text | Inspect a CSR. |
Inspect certificates
| Command | What it does |
|---|---|
openssl x509 -in cert.pem -text -noout | Show all certificate details. |
openssl x509 -in cert.pem -noout -dates | Show validity dates. |
openssl x509 -in cert.pem -noout -subject -issuer | Show who the certificate is for and who issued it. |
openssl x509 -in cert.pem -noout -ext subjectAltName | Show the hostnames it covers. |
openssl verify -CAfile ca.pem cert.pem | Verify a certificate against a CA file. |
Test a live server
| Command | What it does |
|---|---|
openssl s_client -connect host:443 -servername host | Open a TLS connection and print the certificate chain. |
echo | openssl s_client -connect host:443 -servername host 2>/dev/null | openssl x509 -noout -dates | Check when a site's certificate expires. |
openssl s_client -connect host:443 -tls1_2 | Test whether the server supports TLS 1.2. |
openssl s_client -connect host:25 -starttls smtp | Test STARTTLS on a mail server. |
Convert and match
| Command | What it does |
|---|---|
openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem | Bundle a key and certificate into a PKCS#12 file. |
openssl x509 -in cert.der -inform der -out cert.pem | Convert DER to PEM. |
openssl x509 -noout -modulus -in cert.pem | openssl md5 | Fingerprint of the certificate's key; compare with the next line. |
openssl rsa -noout -modulus -in key.pem | openssl md5 | If this matches the line above, the key belongs to the certificate. |
Random data, hashes and encryption
| Command | What it does |
|---|---|
openssl rand -hex 32 | 32 random bytes as hex, good for secrets. |
openssl rand -base64 32 | 32 random bytes as Base64. |
openssl dgst -sha256 file | SHA-256 hash of a file. |
openssl enc -aes-256-cbc -pbkdf2 -salt -in file -out file.enc | Encrypt a file with a password. |
openssl enc -d -aes-256-cbc -pbkdf2 -in file.enc -out file | Decrypt it. |
Frequently asked questions
How do I check when a certificate expires?
Run echo | openssl s_client -connect host:443 -servername host 2>/dev/null | openssl x509 -noout -enddate.
How do I check that a key matches a certificate?
Compare the modulus hashes of both; if the MD5 values are identical they belong together.