openssl

OpenSSL Cheat Sheet 😎

A practical, no-nonsense guide from beginner to advanced.
All commands assume openssl is installed and in your $PATH.

0. Quick Concepts (Read This First)

Common file formats:

📚 Table of Contents

1. Check OpenSSL Version

openssl version
openssl version -a   # with build info

2. Generate Private Keys

2.1 RSA Private Key

# 2048-bit RSA key (enough for most uses)
openssl genrsa -out server.key 2048

# 4096-bit (stronger but heavier)
openssl genrsa -out server-4096.key 4096

2.2 RSA Private Key (Modern genpkey)

openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048

2.3 EC (Elliptic Curve) Private Key

# List available curves
openssl ecparam -list_curves

# Generate EC key using prime256v1 (aka secp256r1)
openssl ecparam -name prime256v1 -genkey -noout -out server-ec.key

2.4 Convert Key WITH or WITHOUT Password

# Add password to private key (PEM)
openssl rsa -aes256 -in server.key -out server-protected.key

# Remove password (be careful!)
openssl rsa -in server-protected.key -out server-nopass.key

3. Create a CSR (Certificate Signing Request)

3.1 Simple CSR (Interactive Questions)

openssl req -new -key server.key -out server.csr

You’ll be asked for:

3.2 Non-Interactive CSR (using a config file)

openssl.cnf example snippet:

[ req ]
default_bits       = 2048
default_md         = sha256
prompt             = no
distinguished_name = dn
req_extensions     = req_ext

[ dn ]
C  = US
ST = Some-State
L  = Some-City
O  = My Company
OU = IT
CN = example.com

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = example.com
DNS.2 = www.example.com

Generate CSR:

openssl req -new -key server.key -out server.csr -config openssl.cnf

4. Self-Signed Certificates (for testing)

4.1 Quick Self-Signed Cert (No CSR file)

openssl req -x509 -newkey rsa:2048 -keyout server.key -out server.crt \
  -days 365 -nodes

4.2 Self-Sign From Existing Key + CSR

openssl x509 -req -in server.csr -signkey server.key -out server.crt -days 365

5. View and Inspect Files

5.1 View Certificate (Human-Readable)

openssl x509 -in server.crt -noout -text

5.2 View CSR

openssl req -in server.csr -noout -text

5.3 View Private Key Details

# RSA key
openssl rsa -in server.key -check -noout

# EC key
openssl ec -in server-ec.key -check -noout

5.4 Extract Public Key from Private Key or Certificate

# From private key
openssl pkey -in server.key -pubout -out server.pub

# From certificate
openssl x509 -in server.crt -pubkey -noout > server.pub

6. File Formats: PEM, DER, PFX, etc.

6.1 PEM ⇔ DER

# PEM cert -> DER
openssl x509 -in server.crt -outform der -out server.der

# DER cert -> PEM
openssl x509 -in server.der -inform der -out server.pem

6.2 Create PKCS#12 (.pfx / .p12)

# Key + cert -> PFX
openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt

# Key + cert + chain -> PFX
openssl pkcs12 -export -out server.pfx \
  -inkey server.key \
  -in server.crt \
  -certfile chain.crt

6.3 Extract from PKCS#12

# Extract private key
openssl pkcs12 -in server.pfx -nocerts -out server.key

# Extract certificate
openssl pkcs12 -in server.pfx -clcerts -nokeys -out server.crt

# Extract everything
openssl pkcs12 -in server.pfx -nodes -out all.pem

7. Hashing & Checksums

7.1 Hash a File

openssl dgst -md5 file.txt
openssl dgst -sha1 file.txt
openssl dgst -sha256 file.txt
openssl dgst -sha512 file.txt

7.2 Hash with HMAC (Keyed Hash)

openssl dgst -sha256 -hmac "secretkey" file.txt

8. Symmetric Encryption (AES, etc.)

Note: built-in enc is ok for quick stuff, but for serious security use modern tools/libs.

8.1 Encrypt a File (Password-Based)

# AES-256-CBC encryption
openssl enc -aes-256-cbc -salt -in plain.txt -out encrypted.bin

You’ll be asked for a password.

8.2 Decrypt a File

openssl enc -d -aes-256-cbc -in encrypted.bin -out decrypted.txt

8.3 Encrypt/Decrypt with Base64 Output

# Encrypt and output Base64
openssl enc -aes-256-cbc -salt -in plain.txt -out encrypted.b64 -base64

# Decrypt from Base64
openssl enc -d -aes-256-cbc -in encrypted.b64 -out decrypted.txt -base64

9. Asymmetric Crypto: Sign & Verify

9.1 Sign a File (Detached Signature)

# Create signature.sig using private key
openssl dgst -sha256 -sign private.key -out file.sig file.txt

9.2 Verify Signature

# Verify with public key
openssl dgst -sha256 -verify public.pem -signature file.sig file.txt

(Exit code 0 = success, non-zero = failure.)

10. Check Certificate Chains & Expiry

10.1 Basic Certificate Info

openssl x509 -in server.crt -noout -subject -issuer -dates

10.2 Verify a Cert Against a CA

openssl verify -CAfile ca.crt server.crt

10.3 Verify with Intermediate Chain

# ca-chain.crt contains intermediate + root
openssl verify -CAfile ca-chain.crt server.crt

11. Debugging TLS / HTTPS Connections

11.1 Connect to a TLS Server (s_client)

openssl s_client -connect example.com:443

11.2 Show Server Certificate

openssl s_client -connect example.com:443 -showcerts

11.3 Check a Specific SNI / Hostname

openssl s_client -connect example.com:443 -servername example.com

11.4 Test SMTP over STARTTLS (Example: port 587)

openssl s_client -starttls smtp -connect mail.example.com:587

Other -starttls options: http, imap, pop3, ftp, etc.

12. Generate Diffie-Hellman Parameters

(Used in some older configs; modern setups often use ECDHE instead.)

openssl dhparam -out dhparam.pem 2048

13. Password & Random Utilities

13.1 Generate Random Bytes

# 16 random bytes as hex
openssl rand -hex 16

# 32 random bytes, base64
openssl rand -base64 32

13.2 Generate Password Hash (for /etc/shadow style)

# SHA-512 based password hash (interactive)
openssl passwd -6

Common switches:

14. Mini “What the heck is this file?” Guide

# Try as certificate
openssl x509 -in unknown-file -noout -text

# Try as CSR
openssl req -in unknown-file -noout -text

# Try as private key
openssl rsa -in unknown-file -check -noout    # RSA
openssl ec  -in unknown-file -check -noout    # EC

# Try to see if it's a PKCS#12 bundle
openssl pkcs12 -in unknown-file -info

If one of those works → you know what you have 🙂

15. Common One-Liners

15.1 Quickly Check Certificate Expiry of a Site

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -dates

15.2 Get Only the CN (Common Name)

openssl x509 -in server.crt -noout -subject
# then look for CN=

15.3 Convert NGINX/Apache Style Chain

# Combine leaf + intermediate into one chain file
cat server.crt intermediate.crt > fullchain.crt

16. Tips & Best Practices

17. Quick Reference Table

Task Command (short version)
Generate RSA key openssl genrsa -out key.pem 2048
Generate EC key openssl ecparam -name prime256v1 -genkey -out key.pem
Create CSR openssl req -new -key key.pem -out req.csr
Self-signed cert openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
View cert openssl x509 -in cert.pem -noout -text
View CSR openssl req -in req.csr -noout -text
Cert → DER openssl x509 -in cert.pem -outform der -out cert.der
Make PFX openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem
Verify cert openssl verify -CAfile ca.pem cert.pem
Hash file (SHA-256) openssl dgst -sha256 file
Random 32 bytes (base64) openssl rand -base64 32
Connect to HTTPS openssl s_client -connect example.com:443

Feel free to copy this file as OPENSSL-CHEATSHEET.md into your GitHub repo.


::contentReference[oaicite:0]{index=0}