OpenSSL Command Cheatsheet & Solutions
Fast, copyable terminal solutions for SSL/TLS certificates and cryptographic keys. Generate self-signed certificates, check expiration dates, verify private key modulus matches, and convert PFX/DER to PEM without memorizing cryptic CLI flags.
How to Generate a Self-Signed SSL Certificate with OpenSSL
Create a standalone 4096-bit RSA private key and self-signed X.509 certificate for local HTTPS testing or staging servers.
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 -nodes -subj "/CN=localhost"How to Check SSL Certificate Expiration Date from Domain or File
Query a live HTTPS domain or local file to display notBefore and notAfter certificate expiration dates.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -datesHow to View and Inspect SSL Certificate Details (Subject, Issuer, SAN)
Print complete human-readable details of an X.509 certificate including Subject, Issuer, Serial Number, and Subject Alternative Names (SANs).
openssl x509 -in cert.pem -text -nooutHow to Verify Private Key Matches SSL Certificate (Modulus MD5 Check)
Ensure that a private key and an SSL certificate are an exact cryptographic pair before deploying them to web servers.
openssl x509 -noout -modulus -in cert.pem | openssl md5 && openssl rsa -noout -modulus -in key.pem | openssl md5How to Generate a Certificate Signing Request (CSR) with SAN
Generate a new private key and CSR including Subject Alternative Names (SANs) required by modern browsers and CAs.
openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"How to Convert PFX / PKCS#12 to PEM Certificate and Private Key
Extract individual PEM private key and certificate files from a password-protected Windows / IIS .pfx or .p12 bundle.
openssl pkcs12 -in bundle.pfx -nocerts -out key.pem -nodes && openssl pkcs12 -in bundle.pfx -clcerts -nokeys -out cert.pemHow to Convert CRT, CER or DER to PEM Format
Convert binary DER-encoded SSL certificates (.cer or .der) to standard ASCII base64 PEM format.
openssl x509 -inform der -in certificate.cer -out certificate.pemHow to Generate a Secure RSA Private Key (2048 or 4096 bit)
Generate a standalone, high-entropy 2048-bit or 4096-bit RSA private key for SSL/TLS, SSH, or JWT authentication.
openssl genrsa -out private.key 4096How to Remove Passphrase from an RSA Private Key for NGINX/Apache
Decrypt a passphrase-protected RSA private key so automated web servers can boot without manual password entry.
openssl rsa -in encrypted.key -out decrypted.keyHow to Test TLS Handshake, Protocols, and Cipher Suites with s_client
Diagnose TLS handshake negotiation, verify supported protocol versions (TLS 1.2 vs 1.3), and check negotiated cipher suites.
openssl s_client -connect example.com:443 -servername example.com -tls1_3 -briefSSL / TLS Certificate File Formats & Encodings
Understanding file extensions, binary representations, and server compatibility
| Format / Extension | Encoding | Header / Structure | Primary Use Case |
|---|---|---|---|
| PEM (.pem, .crt, .cer) | Base64 ASCII | -----BEGIN CERTIFICATE----- | Standard for NGINX, Apache, Node.js, Caddy & Cloudflare |
| DER (.der, .cer) | Binary ASN.1 | Raw byte stream (no headers) | Java Keystores, Windows legacy systems & hardware HSMs |
| PKCS#12 (.pfx, .p12) | Binary encrypted bundle | Password-protected archive | Microsoft Windows, IIS Server, Tomcat & Apple Keychain |
| CSR (.csr) | Base64 ASCII | -----BEGIN CERTIFICATE REQUEST----- | Application sent to CA for signing; contains no private keys |
| Private Key (.key) | Base64 ASCII | -----BEGIN RSA PRIVATE KEY----- | Cryptographic secret kept on server; never shared publicly |
Frequently Asked Questions About OpenSSL Commands
Frequently Asked Questions
Everything you need to know regarding specifications, syntax, and security best practices.
Run: `openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates`. This prints the notBefore and notAfter expiration timestamps.