CertGuru

How these commands are tested

Certificate documentation rots. This page explains the mechanism that stops it rotting here, so you can judge how much to trust what you read on the rest of the site.

The problem this solves

Most published OpenSSL guidance was written against OpenSSL 1.0.2 or 1.1.1 and has never been revisited. OpenSSL 3.0 changed several defaults in ways that break silently rather than loudly — the PKCS#12 export cipher moved to AES-256-CBC, a range of legacy algorithms moved into a provider that is not loaded by default, and -nodes was superseded by -noenc. A command copied from a 2016 blog post still runs; it just produces a file that Windows or Java quietly refuses to open, and the error message points nowhere useful.

Nothing about a written page tells you which category it falls into. So this site does not ask you to take its word for it.

What actually happens on every build

  1. A build step walks every .mdx file and extracts each command block that the author marked with verify.
  2. Each block is written into a scratch directory alongside a set of fixtures — a CA, an intermediate, a server certificate, matching keys in several formats, and a PKCS#12 archive.
  3. The block runs inside an openssl:3.5.7 container under set -euo pipefail, with a timeout and no network access.
  4. A non-zero exit fails the build. The page does not deploy with a command that does not run. 
npm run verify:commands

What this does and does not prove

It proves that a verified command:

  • parses — no typo, no flag that was removed or renamed;
  • runs to completion against a realistic input on OpenSSL 3.5.7;
  • still did so at the moment this page was published, not at some point in the past.

It does not prove that the command is the right one for your situation, and it cannot.

Reading the version stamp

Every reference page carries a line reading Verified against OpenSSL 3.5.7. That is the exact build the commands on that page were last executed against, not a claim about every OpenSSL version in existence. Where behaviour differs between 1.1.1 and 3.x — and it often does — the page says so explicitly rather than silently assuming one of them.

Corrections

If a command here is wrong, dangerous, or produces something subtly different from what the page claims, that is a bug and it is worth reporting. See the about page for how to get in touch.