Linux

openssl

openssl commands for generating keys, inspecting certificates, converting formats and testing TLS.

Key Generation

openssl genrsa -out key.pem 4096Generate a 4096-bit RSA private key

openssl ecparam -genkey -name prime256v1 -out key.pemGenerate an EC key (P-256)

openssl genpkey -algorithm ed25519 -out key.pemGenerate an Ed25519 key

openssl rand -hex 32Generate 32 random bytes as hex

openssl req -new -key key.pem -out cert.csrGenerate a Certificate Signing Request

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodesSelf-signed cert in one step

openssl req -x509 -key key.pem -in cert.csr -out cert.pem -days 365Sign a CSR with an existing key

openssl x509 -in cert.pem -text -nooutDisplay full certificate details

openssl x509 -in cert.pem -subject -nooutShow subject

openssl x509 -in cert.pem -issuer -nooutShow issuer

openssl x509 -in cert.pem -dates -nooutShow validity dates

openssl x509 -in cert.pem -fingerprint -nooutShow certificate fingerprint

openssl req -in cert.csr -text -nooutInspect a CSR

openssl s_client -connect host:443Connect and inspect TLS handshake

openssl s_client -connect host:443 -servername hostSNI-aware TLS check

openssl verify -CAfile ca.pem cert.pemVerify cert against a CA

openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -datesCheck remote cert expiry

openssl pkcs12 -export -in cert.pem -inkey key.pem -out bundle.p12PEM → PKCS12

openssl pkcs12 -in bundle.p12 -out cert.pem -nodesPKCS12 → PEM

openssl x509 -in cert.pem -outform DER -out cert.derPEM → DER

openssl x509 -in cert.der -inform DER -out cert.pemDER → PEM

openssl dgst -sha256 file.txtSHA-256 hash of a file

openssl enc -aes-256-cbc -in file.txt -out file.encEncrypt a file (AES-256)

openssl enc -d -aes-256-cbc -in file.enc -out file.txtDecrypt a file

openssl passwd -6 mypasswordGenerate a SHA-512 hashed password