Linux & Terminal · Cheatsheet
OpenSSL Certificates Cheatsheet
Inspect PEM certs, CSRs, and keys, convert formats, verify chains, and probe live TLS
31 commands 7 sections
No entry matches that filter.
-
openssl x509 -in cert.pem -text -nooutPrint a certificate -
openssl x509 -in cert.pem -noout -subject -issuer -datesSubject, issuer, and dates -
openssl x509 -in cert.pem -noout -ext subjectAltNamePrint SAN -
openssl x509 -in cert.pem -noout -fingerprint -sha256SHA-256 fingerprint -
openssl req -in csr.pem -text -nooutPrint a CSR -
openssl crl -in crl.pem -text -nooutPrint a CRL
-
openssl pkey -in key.pem -text -nooutInspect a private key (prints material) -
openssl pkey -in key.pem -puboutWrite the public key -
openssl pkey -in key.pem -checkCheck key consistency -
openssl genpkey -algorithm RSA -out key.pem -pkeyopt rsa_keygen_bits:2048Generate an RSA key -
openssl genpkey -algorithm ED25519 -out key.pemGenerate an Ed25519 key -
openssl rsa -in key.pem -puboutRSA public key from an RSA key file
-
openssl req -new -key key.pem -out req.csrCreate a CSR -
openssl req -new -x509 -key key.pem -out cert.pem -days 365Self-signed certificate -
openssl x509 -req -in req.csr -signkey key.pem -out cert.pem -days 90Sign a CSR with a key -
openssl req -new -x509 -nodes -newkey rsa:2048 -keyout key.pem -out cert.pem -days 30 -subj "/CN=localhost"One-shot local cert and key
-
openssl x509 -in cert.der -inform DER -out cert.pemDER cert to PEM -
openssl x509 -in cert.pem -outform DER -out cert.derPEM cert to DER -
openssl pkcs12 -in bundle.p12 -nodes -out bundle.pemPKCS#12 to PEM -
openssl pkcs12 -export -in cert.pem -inkey key.pem -out bundle.p12PEM cert and key to PKCS#12 -
openssl x509 -in cert.pem -noout -pubkeyExtract the cert public key
-
openssl verify -CAfile ca.pem cert.pemVerify a cert against a CA file -
openssl verify -untrusted chain.pem -CAfile root.pem leaf.pemVerify with intermediates -
openssl x509 -in cert.pem -noout -checkend 86400Fail if cert ends within 1 day -
openssl ocsp -issuer ca.pem -cert cert.pem -url http://ocsp.example/Query OCSP for a cert -
diff <(openssl x509 -in a.pem -noout -modulus) <(openssl pkey -in key.pem -noout -modulus)Check cert and key modulus match
-
openssl s_client -connect host:443 -servername hostOpen a TLS session -
openssl s_client -connect host:443 -servername host </dev/null | openssl x509 -noout -textShow the presented cert -
openssl s_client -connect host:443 -showcertsPrint the cert chain -
echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -datesPrint live notBefore/notAfter
-
https://docs.openssl.org/3.6/man1/openssl/OpenSSL 3.6 command index: certificate, key, verification, and TLS commands.