OpenSSL

Cheatsheet#openssl

openssl is the standard command-line cryptography toolkit for managing SSL/TLS certificates, private keys, CSRs, and verifying secure network connections.

Key & CSR Generation

1. Generate RSA Private Key & Certificate Signing Request (CSR)

# Generate 2048-bit RSA Private Key + CSR (Interactive)
openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr
 
# Generate 4096-bit RSA Private Key + CSR with Non-Interactive Subject
openssl req -new -newkey rsa:4096 -nodes \
  -keyout domain.key \
  -out domain.csr \
  -subj "/C=ID/ST=Jakarta/L=Jakarta/O=MyCompany/OU=IT/CN=domain.com"

2. Generate Modern ECC (ECDSA) Private Key & CSR

ECDSA keys (P-256 / P-384) provide stronger security with much smaller key sizes and faster handshake performance than RSA.

# Generate ECDSA Prime256v1 (P-256) Private Key
openssl ecparam -name prime256v1 -genkey -noout -out domain.key
 
# Create CSR from existing ECDSA Private Key
openssl req -new -key domain.key -out domain.csr -subj "/CN=domain.com"

Self-Signed Certificates

Create self-signed certificates for local development, internal staging, or lab environments.

# Create a 365-day Self-Signed RSA Certificate in a single command
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout dev.key \
  -out dev.crt \
  -subj "/C=ID/ST=Jakarta/L=Jakarta/O=DevEnv/CN=localhost"
 
# Create Self-Signed Certificate with SAN (Subject Alternative Names - multiple domains/IPs)
openssl req -x509 -newkey rsa:2048 -nodes -days 365 \
  -keyout dev.key -out dev.crt \
  -subj "/CN=dev.local" \
  -addext "subjectAltName=DNS:dev.local,DNS:*.dev.local,IP:127.0.0.1"

Checking & Verifying Certificates

Inspecting Local Files

# View Certificate Signing Request (CSR) details
openssl req -text -noout -verify -in domain.csr
 
# View Public Certificate details (Issuer, Expiry date, SANs, Fingerprint)
openssl x509 -text -noout -in domain.crt
 
# Check Certificate Expiration Date only
openssl x509 -enddate -noout -in domain.crt
 
# Verify Private Key matches Certificate (Hashes must match)
openssl x509 -noout -modulus -in domain.crt | openssl md5
openssl rsa -noout -modulus -in domain.key | openssl md5

Checking Remote Servers (Live SSL/TLS Inspection)

# Connect to remote HTTPS server and display raw certificate chain
openssl s_client -connect domain.com:443 -servername domain.com
 
# Check remote SSL certificate expiration date directly
echo | openssl s_client -servername domain.com -connect domain.com:443 2>/dev/null | openssl x509 -enddate -noout
 
# Inspect SMTP STARTTLS connection (Port 25 / 587)
openssl s_client -starttls smtp -connect mail.domain.com:25 -servername mail.domain.com
 
# Inspect IMAP STARTTLS connection (Port 143)
openssl s_client -starttls imap -connect mail.domain.com:143

Certificate Format Conversions

PEM (`.crt`, `.pem`, `.key`) to PKCS#12 (`.pfx`, `.p12`)

Used for Windows Server IIS or Java keystores.

# Combine Private Key + Certificate + Intermediate Chain into .pfx
openssl pkcs12 -export -out domain.pfx \
  -inkey domain.key \
  -in domain.crt \
  -certfile chain.crt

PKCS#12 (`.pfx`) to PEM (`.crt` / `.key`)

Extract components from Windows .pfx files.

# Extract Private Key from PFX (Encrypted)
openssl pkcs12 -in domain.pfx -nocerts -out domain.key
 
# Extract Private Key without passphrase (Unencrypted)
openssl pkcs12 -in domain.pfx -nocerts -nodes -out domain.key
 
# Extract Certificates only
openssl pkcs12 -in domain.pfx -clcerts -nokeys -out domain.crt

DER (Binary `.der`, `.cer`) to PEM (`.crt`)

# Convert DER binary certificate to ASCII PEM format
openssl x509 -inform der -in certificate.cer -out certificate.crt
 
# Convert PEM certificate to DER binary format
openssl x509 -outform der -in certificate.crt -out certificate.der

Encrypting & Decrypting Files

# Encrypt a file using AES-256-CBC
openssl enc -aes-256-cbc -salt -pbkdf2 -in secret.txt -out secret.txt.enc
 
# Decrypt an AES-256-CBC encrypted file
openssl enc -d -aes-256-cbc -pbkdf2 -in secret.txt.enc -out secret.txt

Cheatsheets