OpenSSL Favorites

# Verify certificate chain
openssl verify -CAfile ~/.secrets/certs/d000/domus-ca-chain.pem /etc/ssl/certs/modestus-razer-eaptls.pem

# Full certificate details
openssl x509 -in /etc/ssl/certs/modestus-razer-eaptls.pem -text -noout

# Check expiry dates for all certs in directory
for cert in /etc/ssl/certs/*.pem; do
  expiry=$(openssl x509 -enddate -noout -in "$cert" 2>/dev/null | cut -d= -f2)
  printf "%-50s %s\n" "$(basename "$cert")" "$expiry"
done

# Fetch and inspect remote certificate
echo | openssl s_client -connect ise-01.inside.domusdigitalis.dev:443 -servername ise-01 2>/dev/null | \
  openssl x509 -noout -subject -issuer -dates -fingerprint

# Generate CSR for Vault PKI
openssl req -new -key /etc/ssl/private/host.key \
  -out /tmp/host.csr \
  -subj "/CN=newhost.inside.domusdigitalis.dev"

# Export to PKCS12 for Windows import
openssl pkcs12 -export \
  -in /etc/ssl/certs/host.pem \
  -inkey /etc/ssl/private/host.key \
  -certfile ~/.secrets/certs/d000/domus-ca-chain.pem \
  -out /tmp/host.pfx