Here’s a cheat sheet for using OpenSSL, a versatile open-source tool for working with SSL/TLS protocols and certificates:
Generate SSL/TLS Key and Certificate
Generate a Private Key:
openssl genpkey -algorithm RSA -out private_key.pem
Generate a Self-Signed Certificate:
openssl req -x509 -new -key private_key.pem -out certificate.pem -days 365
Certificate Signing Request (CSR)
Generate a CSR:
openssl req -new -key private_key.pem -out csr.pem
Viewing Certificates
View Certificate Information:
openssl x509 -in certificate.pem -noout -text
View CSR Information:
openssl req -in csr.pem -noout -text
Verify Certificates
Verify a Certificate Against CA:
openssl verify -CAfile ca.pem certificate.pem
Convert Certificate Formats
Convert PEM to DER:
openssl x509 -in certificate.pem -outform der -out certificate.der
Convert PEM to PKCS#12 (PFX):
openssl pkcs12 -export -in certificate.pem -inkey private_key.pem -out certificate.pfx
Certificate Chains
Create a Certificate Chain File:
cat certificate.pem intermediate.pem > chain.pem
Key Management
Extract Public Key from Private Key:
openssl pkey -in private_key.pem -pubout -out public_key.pem
Encrypt and Decrypt with RSA:
openssl rsautl -encrypt -pubin -inkey public_key.pem -in plaintext.txt -out encrypted.txt
openssl rsautl -decrypt -inkey private_key.pem -in encrypted.txt -out decrypted.txt
Generate Strong Random Numbers
Generate Random Hex String:
openssl rand -hex 16
OpenSSL as a Simple Web Server
Serve a Directory over HTTPS:
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
openssl s_server -key key.pem -cert cert.pem -accept 44330 -www
Access the server at https://localhost:44330/
Miscellaneous
Check OpenSSL Version:
openssl version
Digest Algorithms:
- OpenSSL supports various digest algorithms, including MD5, SHA-1, SHA-256, etc.
This cheat sheet covers some common OpenSSL commands. For more details and advanced usage, refer to the official OpenSSL documentation or use the man
command in the terminal (man openssl
).