Linux & Terminal

OpenSSL Certificates

Inspect PEM certs, CSRs, and keys, convert formats, verify chains, and probe live TLS

31 entries7 sectionsCopy an entry or print the full reference.

31 entries · Use the copy icon.

Inspect PEM

6 entries

Inspect PEM: syntax and descriptions
Syntax	Description
`openssl x509 -in cert.pem -text -noout`	Print a certificate
`openssl x509 -in cert.pem -noout -subject -issuer -dates`	Subject, issuer, and dates
`openssl x509 -in cert.pem -noout -ext subjectAltName`	Print SAN
`openssl x509 -in cert.pem -noout -fingerprint -sha256`	SHA-256 fingerprint
`openssl req -in csr.pem -text -noout`	Print a CSR
`openssl crl -in crl.pem -text -noout`	Print a CRL

Keys

6 entries

Keys: syntax and descriptions
Syntax	Description
`openssl pkey -in key.pem -text -noout`	Inspect a private key (prints material)
`openssl pkey -in key.pem -pubout`	Write the public key
`openssl pkey -in key.pem -check`	Check key consistency
`openssl genpkey -algorithm RSA -out key.pem -pkeyopt rsa_keygen_bits:2048`	Generate an RSA key
`openssl genpkey -algorithm ED25519 -out key.pem`	Generate an Ed25519 key
`openssl rsa -in key.pem -pubout`	RSA public key from an RSA key file

Create certs

4 entries

Create certs: syntax and descriptions
Syntax	Description
`openssl req -new -key key.pem -out req.csr`	Create a CSR
`openssl req -new -x509 -key key.pem -out cert.pem -days 365`	Self-signed certificate
`openssl x509 -req -in req.csr -signkey key.pem -out cert.pem -days 90`	Sign a CSR with a key
`openssl req -new -x509 -nodes -newkey rsa:2048 -keyout key.pem -out cert.pem -days 30 -subj "/CN=localhost"`	One-shot local cert and key

Convert

5 entries

Convert: syntax and descriptions
Syntax	Description
`openssl x509 -in cert.der -inform DER -out cert.pem`	DER cert to PEM
`openssl x509 -in cert.pem -outform DER -out cert.der`	PEM cert to DER
`openssl pkcs12 -in bundle.p12 -nodes -out bundle.pem`	PKCS#12 to PEM
`openssl pkcs12 -export -in cert.pem -inkey key.pem -out bundle.p12`	PEM cert and key to PKCS#12
`openssl x509 -in cert.pem -noout -pubkey`	Extract the cert public key

Verify

5 entries

Verify: syntax and descriptions
Syntax	Description
`openssl verify -CAfile ca.pem cert.pem`	Verify a cert against a CA file
`openssl verify -untrusted chain.pem -CAfile root.pem leaf.pem`	Verify with intermediates
`openssl x509 -in cert.pem -noout -checkend 86400`	Fail if cert ends within 1 day
`openssl ocsp -issuer ca.pem -cert cert.pem -url http://ocsp.example/`	Query OCSP for a cert
`diff <(openssl x509 -in a.pem -noout -modulus) <(openssl pkey -in key.pem -noout -modulus)`	Check cert and key modulus match

Live TLS

4 entries

Live TLS: syntax and descriptions
Syntax	Description
`openssl s_client -connect host:443 -servername host`	Open a TLS session
`openssl s_client -connect host:443 -servername host </dev/null \| openssl x509 -noout -text`	Show the presented cert
`openssl s_client -connect host:443 -showcerts`	Print the cert chain
`echo \| openssl s_client -connect host:443 2>/dev/null \| openssl x509 -noout -dates`	Print live notBefore/notAfter

Sources

1 entries

Sources: syntax and descriptions
Syntax	Description
https://docs.openssl.org/3.6/man1/openssl/	OpenSSL 3.6 command index: certificate, key, verification, and TLS commands.

Related Cheatsheets

Linux & Terminal

Linux Commands

Essential Linux commands for file management, processes, networking, and system administration

61 entriesOpen reference

Linux & Terminal

Bash Scripting

Variables, loops, conditionals, functions, and scripting patterns for Bash shell

53 entriesOpen reference

Linux & Terminal

Vim Editor

Vim modes, movement, editing, copy and paste, search, replacement, and file commands.

64 entriesOpen reference