The openssl shell cheat sheet

Quick reference

Inspect

$openssl x509 -in cert.pem -noout -subject
$openssl x509 -in cert.pem -noout -dates
$openssl x509 -in cert.pem -noout -text
$openssl s_client -connect host:443

Verify

$openssl verify -CAfile ca.pem cert.pem
$openssl verify -untrusted int.pem cert
$openssl x509 -in cert.pem -checkend 0
$openssl x509 -in cert.pem -checkend 86400
$openssl crl -in crl.pem -noout -text

Convert

$openssl x509 -inform der -in c.der
$openssl x509 -in cert.pem -outform der
$openssl pkcs12 -in b.p12 -out b.pem
$openssl pkcs12 -in b.p12 -clcerts -nokeys
$openssl pkey -in k.pem -pubout

Keys

$ssh-keygen -t ed25519 -C "you@host"
$ssh-keygen -lf ~/.ssh/id_ed25519.pub
$ssh-keygen -y -f ~/.ssh/id_ed25519
$ssh-keygen -F host.example.com
$ssh-keygen -R host.example.com
$ssh -Q key

Explained

Inspect

openssl x509 -in cert.pem -noout -subject prints the subject, -dates prints notBefore and notAfter, and -text prints everything, including the public key and extensions. openssl s_client -connect host:443 opens a TLS connection and prints the certificate chain it receives.

Verify

openssl verify -CAfile ca.pem cert.pem checks a leaf against a root. -untrusted int.pem supplies the intermediate. openssl x509 -checkend 0 fails when expired; -checkend 86400 fails within a day. openssl crl -in crl.pem -noout -text reads a revocation list.

Convert

openssl x509 -inform der -in c.der prints a DER certificate as PEM. openssl x509 -in cert.pem -outform der writes the reverse. openssl pkcs12 -in b.p12 -out b.pem exports a PKCS12 bundle; -clcerts -nokeys keeps only the client certificate. openssl pkey -in k.pem -pubout derives the public key.

Keys

ssh-keygen -t ed25519 -C "you@host" makes a key with a comment you can trace. ssh-keygen -lf prints a fingerprint without printing the key. ssh-keygen -y -f prints only the public half of a private key. ssh-keygen -F and -R search and remove host keys; ssh -Q key lists the algorithms this client supports.

In one line

Inspect first

$openssl x509 -in cert.pem -noout -text