Create CSR

Certificate Signing Request for CA submission

openssl req -new -key private.key -out request.csr -subj '/CN=example.com/O=MyOrg/C=RU'
tool
openssl27 commands
tags
opensslsecurity

More openssl commands

  • Self-signed certificate
    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes -subj '/CN=localhost'

    Generate self-signed cert + key in one command

  • View certificate details
    openssl x509 -in cert.pem -noout -text | grep -E 'Subject:|Issuer:|Not (Before|After)|DNS:'

    Show subject, issuer, validity dates, SANs

  • Check cert expiry
    openssl x509 -in cert.pem -noout -dates

    Print notBefore and notAfter dates

  • Verify cert against CA
    openssl verify -CAfile ca.pem cert.pem

    Check certificate chain against a CA bundle

  • Check cert matches key
    diff <(openssl x509 -pubkey -noout -in cert.pem) <(openssl pkey -pubout -in key.pem) && echo 'MATCH'

    Confirm the cert and private key are a pair

all 27 openssl commands