OpenSSL Cheatsheet - OpenSSL Certificate & Encryption Reference
Reinforcing a cert or debugging "handshake failure" means switching between inspection, generation, and TLS tests — OpenSSL covers all three. The recurring pattern is reading back what you just generated to confirm names, validity, and chains; this table keeps those verify loops and the cursor-pointing handshake test together, so cert work becomes a checklist rather than man-page archaeology.
Inspect Certificate 6
openssl x509 -in cert.pem -text -nooutView full cert info (issuer, validity, SAN)
openssl x509 -in cert.pem -dates -nooutShow only validity (notBefore/notAfter)
openssl x509 -in cert.pem -issuer -nooutShow only the issuer
openssl x509 -in cert.pem -subject -nooutShow only the subject (domain)
openssl x509 -in cert.pem -ext subjectAltName -nooutView SAN (all covered domains)
openssl x509 -in cert.pem -fingerprint -sha256 -nooutView the SHA-256 fingerprint
Remote Check 5
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -datesCheck a remote server's cert validity
echo | openssl s_client -connect example.com:443 -showcerts 2>/dev/nullView the full certificate chain
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -text -nooutView full remote cert info
openssl s_client -connect example.com:443 -servername example.com -tls1_2Test a connection with a specific TLS version
openssl s_client -connect example.com:443 -servername example.com -tls1_3Test a TLS 1.3 connection
Generate Certificate 6
openssl genrsa -out private.key 2048Generate a 2048-bit RSA private key
openssl ecparam -genkey -name prime256v1 -out private.keyGenerate an EC private key (smaller, faster)
openssl req -new -key private.key -out request.csrCreate a CSR from the private key
openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csrGenerate key and CSR in one step
openssl req -x509 -newkey rsa:2048 -nodes -keyout private.key -out cert.pem -days 365 -subj "/CN=localhost"Generate a self-signed cert (365 days)
openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,DNS:*.localhost"Self-signed cert with SAN (multi-domain)
Private Key 5
openssl rsa -in private.key -check -nooutCheck whether a private key is valid
openssl rsa -in encrypted.key -out plain.keyRemove passphrase protection (enter the original password)
openssl rsa -in plain.key -aes256 -out encrypted.keyAdd AES-256 passphrase protection
openssl rsa -in private.key -pubout -out public.keyExport the public key from the private key
openssl pkey -in private.key -nooutGeneric key view (RSA and EC)
Format Conversion 4
openssl pkcs12 -export -out cert.p12 -inkey private.key -in cert.pemPEM to PKCS12 (.p12/.pfx)
openssl pkcs12 -in cert.p12 -out cert.pem -nodesPKCS12 to PEM (incl. key, -nodes = unencrypted)
openssl pkcs12 -in cert.p12 -info -nooutView PKCS12 contents
openssl crl2pkcs7 -nocrl -certfile cert.pem -out cert.p7bPEM to PKCS7 (.p7b)
Encrypt & Hash 7
echo -n "hello" | openssl md5Compute an MD5 hash
echo -n "hello" | openssl sha256Compute a SHA-256 hash
openssl dgst -sha256 file.txtCompute a file's SHA-256
openssl enc -aes-256-cbc -in file.txt -out file.enc -pass pass:secretAES-256-CBC encrypt a file
openssl enc -d -aes-256-cbc -in file.enc -out file.txt -pass pass:secretAES-256-CBC decrypt a file
openssl rand -hex 32Generate a 32-byte random hex string
openssl rand -base64 32Generate a 32-byte random Base64 string
Tips
- Add -servername (SNI) when checking remote cert validity, or a multi-domain cert may return the default one.
- Before a Let's Encrypt cert expires, use echo | openssl s_client to confirm the deployed cert actually renewed — don't trust file timestamps.
- Add -nodes when converting PKCS12 to PEM, otherwise the exported key is passphrase-protected and Nginx/Traefik can't read it.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us