OpenSSL Cheat Sheet

Certificates, keys, CSRs, and the TLS handshake checks — stay paranoid with one of the essential crypto tools.

Security4 sections · 24 commands
⌘K

Keys & Certificates

8
openssl genrsa -out key.pem 2048

Generate an RSA private key

openssl genpkey -algorithm ed25519 -out key.pem

Modern Ed25519 key

openssl req -x509 -new -key key.pem -days 365 -out cert.pem

Self-signed cert

openssl req -new -key key.pem -out csr.pem

Generate a CSR

openssl x509 -in cert.pem -text -noout

Inspect certificate fields

openssl x509 -in cert.pem -noout -dates

Validity period

openssl x509 -in cert.pem -noout -subject -issuer

Subject and issuer

openssl x509 -in fullchain.pem -noout -fingerprint -sha256

Certificate fingerprint

Testing TLS Connections

6
openssl s_client -connect host:443

Dump the TLS handshake

openssl s_client -connect host:443 -servername HOST

SNI-aware connection

echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -dates

Cert dates for a live host

echo | openssl s_client -connect host:443 -servername HOST 2>/dev/null | grep -A1 'Verify return'

Verify chain result

openssl s_client -connect host:443 -tls1_2 2>/dev/null >/dev/null; echo $?

Is TLS 1.2 supported

openssl s_client -showcerts -connect host:443 </dev/null 2>/dev/null | openssl x509 -text -noout | head -20

Inspect the served certificate

Hashing & Encryption

6
openssl dgst -sha256 -hmac SECRET FILE

HMAC-SHA256 of a file

openssl enc -aes-256-cbc -salt -in file -out file.enc

Encrypt a file (will prompt)

openssl enc -d -aes-256-cbc -in file.enc -out file

Decrypt a file

openssl rand -base64 32

Random token for secrets

openssl req -text -noout -in csr.pem

Read a CSR

openssl dhparam -out dhparam.pem 2048

DH params for legacy TLS

Formats & Conversion

4
openssl pkcs12 -export -out bundle.pfx -inkey key.pem -in cert.pem

To PKCS#12

openssl pkcs12 -in bundle.pfx -nodes -out key+cert.pem

From PKCS#12

openssl rsa -in key.enc -out key.pem

Strip encryption from a key

openssl crl2pkcs7 -nocrl -certfile cacert.pem | openssl pkcs7 -print_certs -noout

List CA bundle certs