About CertGuru
A reference for certificate operations that is tested rather than copied.
Why this exists
Certificate work is infrequent enough that almost nobody has the commands memorised, and fiddly enough that getting one flag wrong wastes an afternoon. The material available when you go looking is mostly forum answers of unknown age, and a large fraction of it predates OpenSSL 3.0 — which changed defaults in ways that produce files other software silently refuses to open.
CertGuru is an attempt at the reference that should already exist: one page per task, the command first and the explanation after, and an automated check that the command still runs. Every command block marked for verification is executed against OpenSSL 3.5.7 on every build, and a failure stops the deploy. How that works.
Who maintains it
Wickeey — Web developer
CertGuru exists because I got tired of searching for an OpenSSL command, finding four subtly different answers, and discovering that the one which actually worked was written in 2014 for a version of OpenSSL that no longer ships. So I built the reference I kept failing to find — and wired every command into the build, so that I cannot quietly become the fifth wrong answer.
Corrections and requests
If a command here is wrong, unsafe, or does something subtly different from what the page describes, that is worth reporting — it is a bug in the same sense a broken build is. Missing topics are worth mentioning too.
Contact: hello@certguru.io
Independence
No certificate authority or vendor has any input into what is published here, and a command is never recommended because it routes traffic somewhere useful to me. The certificate tools load no third-party scripts at all, because anything loaded from elsewhere would contradict the guarantee those pages make.
Scope
The material here is reference documentation, not advice about your specific system. Commands that write or overwrite files are exactly as destructive as they look; read one before running it against something you care about, and keep backups of private keys you cannot regenerate.