openssl

What it does

How to write it

openssl SUBCOMMAND [OPTIONS]

Main parts

Subcommands

genpkey / req / x509

Keys / requests / certificates.

s_client

Connect to a TLS server and show the handshake.

x509 -in FILE -noout -text

Read a certificate.

verify

Check a certificate chain.

pkcs12

Make or read .pfx/.p12 bundles.

rand

Random bytes (passwords, keys).

dgst

Hashes and signatures (sha256).

enc

Symmetric encryption of files.

pkey

Read and convert private keys.

ciphers

List cipher suites.

version -a

Version and settings.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Make a key and a CSR with SAN names

   $openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out shop.key
   $openssl req -new -key shop.key -out shop.csr -subj "/CN=shop.example.com" -addext "subjectAltName=DNS:shop.example.com,DNS:www.shop.example.com"
   $openssl req -in shop.csr -noout -text | grep -A1 "Subject Alternative"

2. 2A self-signed certificate for a lab

   $openssl req -x509 -newkey rsa:3072 -nodes -keyout lab.key -out lab.crt -days 365 -subj "/CN=lab.local" -addext "subjectAltName=DNS:lab.local,IP:192.168.122.10"

3. 3Read a certificate

   $openssl x509 -in shop.crt -noout -subject -issuer -dates
   $openssl x509 -in shop.crt -noout -ext subjectAltName

4. 4Check expiry of a live site

   $echo | openssl s_client -connect s0sta.com:443 -servername s0sta.com 2>/dev/null | openssl x509 -noout -enddate
   notAfter=Jan 20 09:12:44 2027 GMT

5. 5Will it expire within 30 days? (for monitoring)

   $openssl x509 -in shop.crt -noout -checkend 2592000 && echo "OK" || echo "Expires soon"

6. 6Test which TLS versions a server accepts

   $openssl s_client -connect shop.example.com:443 -tls1_1 </dev/null
   $openssl s_client -connect shop.example.com:443 -tls1_3 </dev/null 2>/dev/null | grep -E "Protocol|Cipher"

7. 7Test mail server TLS

   $openssl s_client -connect mail.example.com:587 -starttls smtp </dev/null | head -20

8. 8Check that a key and a certificate belong together

   $openssl x509 -in shop.crt -noout -pubkey | openssl sha256
   $openssl pkey -in shop.key -pubout | openssl sha256

9. 9Verify a chain

   $openssl verify -CAfile chain.pem shop.crt

10. 10Make a .pfx for Windows / Azure

    $openssl pkcs12 -export -inkey shop.key -in shop.crt -certfile chain.pem -out shop.pfx

11. 11Random password and file hash

    $openssl rand -base64 24
    $openssl dgst -sha256 release.tar.gz

Nothing matches this filter.

Files

/etc/pki/tls/

Certificates and keys on RHEL (certs/, private/).

/etc/pki/ca-trust/source/anchors/

Add your own CA here, then update-ca-trust.

/etc/crypto-policies/

System crypto policy.

Exit codes