OpenSSL Commands

Every common OpenSSL invocation for keys, CSRs, certificates and certificate authorities, with the flags explained.

• Generate a private key

  Use openssl genpkey for RSA, EC and Ed25519 keys. It writes PKCS#8 by default, which is what modern libraries expect, unlike the older genrsa.

• Generate a certificate signing request

  Create a private key and CSR in one command, or a CSR from a key you already have. Includes what each subject field means and which ones the CA checks.

• Generate a CSR with Subject Alternative Names

  Create a CSR covering multiple hostnames with openssl req -addext, or a config file on older OpenSSL, and verify the SANs are present before you submit it.

• Generate a self-signed certificate

  Create a key and self-signed certificate in one command, with the subject alternative names browsers require. Includes why a local CA is usually the better option.

• View and decode a CSR

  Read the subject, SANs and key details out of a certificate signing request, and verify its self-signature before you submit it to a CA.

• View and decode a certificate

  Read a certificate's subject, issuer, validity, SANs and extensions with openssl x509 -text, plus the short flags for pulling out one field at a time.

• Check when a certificate expires

  Read the expiry date of a file or a live server, and test whether it expires within a given window — the form you actually want in a monitoring script.

• Does this private key match this certificate?

  Compare the public key derived from each, which works for RSA and EC alike — unlike the older modulus comparison, which silently does nothing useful for EC keys.

• Fetch a certificate from a live server

  Use openssl s_client to see what a server is actually serving, save the chain to a file, and diagnose the SNI mistakes that make the output misleading.

• Check supported TLS versions and ciphers

  Probe a server one protocol version at a time with s_client, read what was negotiated, and avoid the OpenSSL 3 default that makes old versions look disabled when they are not.

• Verify a certificate chain

  Use openssl verify to confirm a certificate chains to a trusted root, and read the error codes it returns when it does not.

• Create a private root certificate authority

  Build a root CA you can trust once and use to sign every internal certificate, instead of trusting self-signed certificates one at a time.

• Sign a CSR with your own CA

  Issue a certificate from a CSR with openssl x509 -req, and handle the extension-copying problem that silently strips subject alternative names.

• Create an intermediate certificate authority

  Issue a signing CA beneath your root so the root key can stay offline, with the pathlen constraint that stops the intermediate creating further CAs.

• Remove or change a private key passphrase

  Strip the passphrase so a web server can start unattended, add one for a key a human handles, and understand the trade-off between the two.

• Extract the private key from a PFX / P12

  Pull just the private key out of a PKCS#12 archive, strip the bag attributes, and handle archives that OpenSSL 3 refuses to open.

• Extract certificates from a PFX / P12

  Pull the server certificate and the CA chain out of a PKCS#12 archive as separate PEM files, without touching the private key.

• Extract a public key

  Derive the public key from a private key, a certificate or a CSR — and use the result to prove which files belong together.

• Issue a client certificate for mutual TLS

  Generate a key and CSR for a client, then sign it with your private CA using clientAuth extended key usage — the flag that everything hinges on.