OpenSSL

OpenSSL operations for certificate management, key generation, and TLS diagnostics.

Certificate Inspection

View full certificate details — subject, SAN, dates, extensions

openssl x509 -in cert.pem -text -noout

Quick summary — subject, issuer, validity dates

openssl x509 -in cert.pem -subject -issuer -dates -noout

SHA-256 fingerprint of certificate

openssl x509 -in cert.pem -fingerprint -sha256 -noout

Check if cert expires within 30 days — exit code 1 means expiring

openssl x509 -in cert.pem -enddate -noout -checkend 2592000

Extract only the SAN extension from certificate

openssl x509 -in cert.pem -noout -ext subjectAltName

Verify full certificate chain

openssl verify -CAfile ca.pem -untrusted intermediate.pem cert.pem

Test TLS connection with SNI

openssl s_client -connect host:443 -servername host </dev/null

Dump full certificate chain from server

openssl s_client -connect host:443 -showcerts </dev/null 2>/dev/null

Test STARTTLS for SMTP/IMAP/FTP protocols

openssl s_client -connect host:443 -starttls smtp </dev/null

Test LDAPS connection against custom CA

openssl s_client -connect host:636 -CAfile ca.pem </dev/null

One-liner: check remote cert expiry dates

echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -dates

Generate 4096-bit RSA private key

openssl genrsa -out key.pem 4096

Generate Ed25519 private key

openssl genpkey -algorithm ed25519 -out key.pem

Generate P-256 ECDSA private key

openssl ecparam -genkey -name prime256v1 -noout -out key.pem

Generate CSR with subject on command line

openssl req -new -key key.pem -out req.csr -subj "/CN=host.domain"

Generate CSR with SAN from config file

openssl req -new -key key.pem -out req.csr -config san.cnf

Create self-signed CA certificate

openssl req -new -x509 -nodes -days 3650 -keyout ca.key -out ca.pem -subj "/CN=My CA"

Sign CSR with CA — issue certificate

openssl x509 -req -in req.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out cert.pem -days 365

Verify RSA private key integrity

openssl rsa -in key.pem -check -noout

Remove passphrase from encrypted private key

openssl rsa -in enc.key -out dec.key

Create PKCS12 with cert + key + CA chain

openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile ca.pem -out bundle.p12

Extract everything from PKCS12

openssl pkcs12 -in bundle.p12 -out all.pem -nodes

Convert PEM to DER format

openssl x509 -in cert.pem -outform DER -out cert.der

Convert DER to PEM format

openssl x509 -in cert.der -inform DER -outform PEM -out cert.pem

SHA-256 hash of file

openssl dgst -sha256 file

Generate 32-byte random hex string

openssl rand -hex 32

Generate 24-byte random base64 string

openssl rand -base64 24

Encrypt file with AES-256-CBC and PBKDF2

openssl enc -aes-256-cbc -salt -pbkdf2 -in file -out file.enc

List available TLS 1.3 cipher suites

openssl ciphers -v 'TLSv1.3' | awk '{print $1}'