openssl commands

27 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 27 shown

  • Generate RSA private key
    openssl genrsa -out private.key 4096

    Generate a 4096-bit RSA private key

    security

  • Generate Ed25519 key pair
    openssl genpkey -algorithm ed25519 -out private.key && openssl pkey -in private.key -pubout -out public.key

    Modern Ed25519 key (smaller, faster than RSA)

    security

  • Create CSR
    openssl req -new -key private.key -out request.csr -subj '/CN=example.com/O=MyOrg/C=RU'

    Certificate Signing Request for CA submission

    security

  • Self-signed certificate
    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes -subj '/CN=localhost'

    Generate self-signed cert + key in one command

    security

  • View certificate details
    openssl x509 -in cert.pem -noout -text | grep -E 'Subject:|Issuer:|Not (Before|After)|DNS:'

    Show subject, issuer, validity dates, SANs

    security · debug

  • Check cert expiry
    openssl x509 -in cert.pem -noout -dates

    Print notBefore and notAfter dates

    security

  • Verify cert against CA
    openssl verify -CAfile ca.pem cert.pem

    Check certificate chain against a CA bundle

    security · debug

  • Check cert matches key
    diff <(openssl x509 -pubkey -noout -in cert.pem) <(openssl pkey -pubout -in key.pem) && echo 'MATCH'

    Confirm the cert and private key are a pair

    security · debug

  • Convert PEM to PKCS#12
    openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile ca.pem -out bundle.p12 -name myalias

    Package cert + key + CA into a .p12 file

    security

  • Extract cert from PKCS#12
    openssl pkcs12 -in bundle.p12 -nokeys -out cert.pem && openssl pkcs12 -in bundle.p12 -nocerts -nodes -out key.pem

    Split .p12 into separate cert and key PEM files

    security

  • Check live TLS cert
    echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -subject -issuer

    Show expiry and issuer of a live TLS certificate

    security · network

  • Check full cert chain
    openssl s_client -connect example.com:443 -showcerts 2>/dev/null | openssl crl2pkcs7 -nocrl | openssl pkcs7 -print_certs -noout -text | grep -E 'Subject:|Issuer:'

    Display full chain: leaf → intermediate → root

    security · debug

  • Encrypt file with AES-256
    openssl enc -aes-256-cbc -pbkdf2 -in secret.txt -out secret.enc

    Password-encrypt a file with AES-256-CBC + PBKDF2

    security

  • Decrypt AES-256 file
    openssl enc -d -aes-256-cbc -pbkdf2 -in secret.enc -out secret.txt

    Decrypt a file encrypted with the enc command above

    security

  • Generate random hex token
    openssl rand -hex 32

    Generate a 64-char hex random string (e.g. for API keys)

    security

  • Full certificate inspect
    openssl x509 -in cert.pem -noout -text

    Dump all cert fields: subject, issuer, validity, extensions, SANs, key usage

    tls · security · debug

  • Cert expiry check (CI gate)
    openssl x509 -in cert.pem -noout -checkend 86400 && echo OK || echo EXPIRING

    Exit 0 if cert valid >24h; perfect for monitoring/CI alerts on expiry

    monitoring · tls · ci

  • Inspect live server chain
    openssl s_client -connect <host>:443 -servername <host> -showcerts </dev/null 2>/dev/null

    Fetch full chain with SNI; -servername is mandatory for vhosts/SNI backends

    tls · network · debug

  • Extract SAN list
    openssl x509 -in cert.pem -noout -ext subjectAltName

    Show only SAN entries; modern browsers ignore CN, so SAN is what matters

    tls · dns · security

  • Verify cert against CA chain
    openssl verify -CAfile ca-chain.pem cert.pem

    Validate trust chain; note: -CAfile must hold intermediates+root in order

    tls · security · troubleshooting

  • Match cert and private key
    diff <(openssl x509 -in cert.pem -noout -modulus | md5sum) <(openssl rsa -in key.pem -noout -modulus | md5sum)

    Equal modulus hashes prove key matches cert; empty diff = match

    tls · security · troubleshooting

  • CSR + key in one shot
    openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.csr -subj "/CN=<host>" -addext "subjectAltName=DNS:<host>"

    Generate key+CSR with SAN inline; -addext avoids editing openssl.cnf

    tls · security

  • Self-signed cert with SAN
    openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=<host>" -addext "subjectAltName=DNS:<host>"

    One-liner self-signed cert valid 1y; SAN required or TLS clients reject it

    tls · security

  • PEM to PKCS12 bundle
    openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile ca-chain.pem -out bundle.p12 -name <name>

    Bundle cert+key+chain into .p12 for Java keystores / Windows imports

    tls · security

  • STARTTLS protocol probe
    openssl s_client -connect <host>:5432 -starttls postgres -showcerts </dev/null 2>/dev/null

    Inspect TLS on STARTTLS services; swap postgres for smtp/imap/mysql/ldap

    tls · network · debug

  • Generate Ed25519 key
    openssl genpkey -algorithm ed25519 -out ed25519.pem

    Modern: Ed25519 keys are tiny and fast vs RSA; use for signing/mTLS

    security · tls

  • Test specific TLS protocol
    openssl s_client -connect <host>:443 -tls1_2 </dev/null 2>&1 | grep -E 'Protocol|Cipher'

    Force a version to confirm support; use -tls1_3 / -no_tls1_2 to test policy

    tls · security · troubleshooting