Quick Reference

Cheatsheets

Practical command references for Linux, networking, servers, containers, databases, and more.

Cheatsheet#ssl-tls

SSL / TLS (OpenSSL) Cheatsheet

OpenSSL is the industry-standard cryptography toolkit and command-line program used for generating private keys, creating certificate signing requests (CSR), inspecting X.509 certificates, converting key formats, and testing live SSL/TLS network services.

[!NOTE] For automated Let's Encrypt certificates, check out the dedicated Certbot Cheatsheet.

Installation & Version Inspection

# Check installed OpenSSL version and build options
openssl version -a
 
# Install OpenSSL package
# Debian / Ubuntu
sudo apt update && sudo apt install openssl
 
# RHEL / CentOS / Rocky Linux / AlmaLinux
sudo dnf install openssl
 
# Arch Linux
sudo pacman -S openssl
 
# macOS (via Homebrew)
brew install openssl

Private Key Management

RSA Private Keys

# Generate 2048-bit RSA key (standard)
openssl genrsa -out server.key 2048
 
# Generate 4096-bit RSA key (high security)
openssl genrsa -out server.key 4096
 
# Generate AES-256 encrypted RSA private key (passphrase protected)
openssl genrsa -aes256 -out server_protected.key 2048
 
# Remove passphrase from an encrypted private key
openssl rsa -in server_protected.key -out server_unencrypted.key
 
# Encrypt an existing plain private key
openssl rsa -in server.key -aes256 -out server_protected.key

Elliptic Curve (ECDSA & Ed25519) Keys

ECDSA private keys offer equivalent or superior security to RSA with significantly smaller key sizes and faster handshake processing.

# List supported Elliptic Curves
openssl ecparam -list_curves
 
# Generate ECDSA key (prime256v1 / secp256r1)
openssl ecparam -genkey -name prime256v1 -out ec_server.key
 
# Generate ECDSA key (secp384r1)
openssl ecparam -genkey -name secp384r1 -out ec_server.key
 
# Generate Ed25519 private key (modern high-performance curve)
openssl genpkey -algorithm Ed25519 -out ed25519_server.key

Certificate Signing Request (CSR)

A CSR contains domain details and public key to be signed by a Certificate Authority (CA).

Non-Interactive CSR Generation

openssl req -new -key server.key -out server.csr \
  -subj "/C=US/ST=California/L=San Francisco/O=MyCompany Inc/OU=IT/CN=example.com"

CSR with Subject Alternative Names (SAN) via Config File

Modern browsers require the subjectAltName extension (SAN) for single-domain, multi-domain, and wildcard certificates.

Create san.cnf:

[ req ]
default_bits       = 2048
prompt             = no
default_md         = sha256
distinguished_name = req_distinguished_name
req_extensions     = req_ext
 
[ req_distinguished_name ]
C  = US
ST = California
L  = San Francisco
O  = MyCompany
CN = example.com
 
[ req_ext ]
subjectAltName = @alt_names
 
[ alt_names ]
DNS.1 = example.com
DNS.2 = www.example.com
DNS.3 = api.example.com
DNS.4 = *.example.com
IP.1  = 192.168.1.100

Generate key and CSR using config file:

openssl req -new -newkey rsa:2048 -nodes \
  -keyout server.key -out server.csr \
  -config san.cnf

Self-Signed Certificates & Local CA Setup

One-Line Self-Signed Certificate (For Testing)

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout server.key -out server.crt \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com,IP:127.0.0.1"

Creating a Custom Local Certificate Authority (CA)

Useful for internal dev/test environments.

# 1. Generate Root CA Private Key
openssl genrsa -aes256 -out rootCA.key 4096
 
# 2. Generate Root CA Certificate (valid for 10 years)
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 \
  -out rootCA.crt \
  -subj "/C=US/ST=DevState/L=DevCity/O=LocalDevCA/CN=Local Root CA"
 
# 3. Create Server Key and CSR
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr -subj "/CN=myservice.local"
 
# 4. Sign Server Certificate using your Root CA
openssl x509 -req -in server.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial \
  -out server.crt -days 825 -sha256 \
  -extfile <(printf "subjectAltName=DNS:myservice.local,DNS:*.myservice.local")

Inspecting & Verifying SSL Files

View Certificate Details

# View complete certificate fields (issuer, validity, SANs, public key)
openssl x509 -in server.crt -text -noout
 
# Check validity dates only
openssl x509 -in server.crt -noout -dates
 
# Check Subject Name
openssl x509 -in server.crt -noout -subject
 
# Check Issuer Name
openssl x509 -in server.crt -noout -issuer
 
# View Certificate Fingerprints (SHA-256 / SHA-1)
openssl x509 -in server.crt -noout -fingerprint -sha256

View CSR Details

openssl req -in server.csr -text -noout -verify

Verify Key / CSR / Certificate Modulus Matching

To confirm that a .key, .csr, and .crt belong to the exact same cryptographic pair, compare their MD5 hashes. All three output values must match:

openssl x509 -noout -modulus -in server.crt | openssl md5
openssl rsa  -noout -modulus -in server.key | openssl md5
openssl req  -noout -modulus -in server.csr | openssl md5

Verify Certificate Chain

# Verify server certificate against CA chain
openssl verify -CAfile ca-chain.crt server.crt

Format Conversions

Source FormatTarget FormatExtensionOpenSSL Command
PEMDER (Binary).crt / .deropenssl x509 -outform der -in server.pem -out server.der
DERPEM (ASCII).der / .pemopenssl x509 -inform der -in server.der -out server.pem
PEMPKCS12 (IIS/Java).p12 / .pfxopenssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt -certfile ca.crt
PKCS12PEM (Extract All).pfx / .pemopenssl pkcs12 -in server.pfx -out server.pem -nodes
PKCS12PEM Key Only.pfx / .keyopenssl pkcs12 -in server.pfx -nocerts -out server.key -nodes
PKCS7PEM.p7b / .pemopenssl pkcs7 -print_certs -in bundle.p7b -out bundle.pem

Live TLS Testing (openssl s_client)

Test HTTPS Server Connection & Display Certificate

# Connect to target server using Server Name Indication (SNI)
openssl s_client -connect example.com:443 -servername example.com
 
# Print full certificate chain from remote server
openssl s_client -showcerts -connect example.com:443 -servername example.com

Check Remote Certificate Expiration Date

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates

Test Specific TLS Versions

# Test TLS 1.2
openssl s_client -connect example.com:443 -tls1_2 -servername example.com
 
# Test TLS 1.3
openssl s_client -connect example.com:443 -tls1_3 -servername example.com

Test STARTTLS for Mail & Database Servers

# SMTP (Port 587 or 25)
openssl s_client -starttls smtp -connect mail.example.com:587
 
# IMAP (Port 143)
openssl s_client -starttls imap -connect mail.example.com:143
 
# POP3 (Port 110)
openssl s_client -starttls pop3 -connect mail.example.com:110
 
# PostgreSQL (Port 5432)
openssl s_client -starttls postgres -connect db.example.com:5432

Diffie-Hellman (DH) Parameters

Generate DH parameters for custom key exchange secrecy in Nginx or Apache:

# Generate 2048-bit DH parameters file
openssl dhparam -out dhparam.pem 2048

SSL/TLS Common Issues & Solutions

  1. unable to get local issuer certificate

    • Missing intermediate certificate bundle in web server config. Ensure fullchain.pem or CA bundle is concatenated properly: cat server.crt ca.crt > fullchain.pem.

  2. SNI Mismatch / Wrong Host Name

    • Ensure -servername example.com flag is passed when debugging with openssl s_client to properly send SNI headers to virtual hosts.

  3. Passphrase Prompting on Web Server Restart

    • Web servers (Nginx/Apache) will fail to start automatically on boot if private keys are password-protected. Strip key passphrase using openssl rsa -in protected.key -out server.key.