OpenSSL Cheatsheet - OpenSSL Certificate & Encryption Reference

Anyone who has configured TLS has walked the same loop — generate, verify, deploy — and openssl has a command for each stage. The sheet is grouped by stage: inspecting a certificate file for subject, SAN and validity, checking the one a remote endpoint actually serves, generating self-signed certificates and CSRs, handling keys and their permissions, and converting between DER, PEM and PFX. The step people skip and then regret every quarter is the remote check. openssl s_client -connect host:443 -servername name must carry SNI, otherwise a multi-domain server returns its default site certificate and you wrongly conclude the certificate never rotated. The other frequent trap sits in format conversion: converting PKCS12 to PEM without -nodes produces an encrypted key that Nginx and Traefik cannot read, and the error points nowhere near the cause. The troubleshooting order matters: confirm the live certificate first, validate the local file second, and only then edit configuration.

SysOps·33 commands·Last updated 2026-07-21

Inspect Certificate 6

openssl x509 -in cert.pem -text -noout

View full cert info (issuer, validity, SAN)

openssl x509 -in cert.pem -dates -noout

Show only validity (notBefore/notAfter)

openssl x509 -in cert.pem -issuer -noout

Show only the issuer

openssl x509 -in cert.pem -subject -noout

Show only the subject (domain)

openssl x509 -in cert.pem -ext subjectAltName -noout

View SAN (all covered domains)

openssl x509 -in cert.pem -fingerprint -sha256 -noout

View the SHA-256 fingerprint

Remote Check 5

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

Check a remote server's cert validity

echo | openssl s_client -connect example.com:443 -showcerts 2>/dev/null

View the full certificate chain

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -text -noout

View full remote cert info

openssl s_client -connect example.com:443 -servername example.com -tls1_2

Test a connection with a specific TLS version

openssl s_client -connect example.com:443 -servername example.com -tls1_3

Test a TLS 1.3 connection

Generate Certificate 6

openssl genrsa -out private.key 2048

Generate a 2048-bit RSA private key

openssl ecparam -genkey -name prime256v1 -out private.key

Generate an EC private key (smaller, faster)

openssl req -new -key private.key -out request.csr

Create a CSR from the private key

openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr

Generate key and CSR in one step

openssl req -x509 -newkey rsa:2048 -nodes -keyout private.key -out cert.pem -days 365 -subj "/CN=localhost"

Generate a self-signed cert (365 days)

openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,DNS:*.localhost"

Self-signed cert with SAN (multi-domain)

Private Key 5

openssl rsa -in private.key -check -noout

Check whether a private key is valid

openssl rsa -in encrypted.key -out plain.key

Remove passphrase protection (enter the original password)

openssl rsa -in plain.key -aes256 -out encrypted.key

Add AES-256 passphrase protection

openssl rsa -in private.key -pubout -out public.key

Export the public key from the private key

openssl pkey -in private.key -noout

Generic key view (RSA and EC)

Format Conversion 4

openssl pkcs12 -export -out cert.p12 -inkey private.key -in cert.pem

PEM to PKCS12 (.p12/.pfx)

openssl pkcs12 -in cert.p12 -out cert.pem -nodes

PKCS12 to PEM (incl. key, -nodes = unencrypted)

openssl pkcs12 -in cert.p12 -info -noout

View PKCS12 contents

openssl crl2pkcs7 -nocrl -certfile cert.pem -out cert.p7b

PEM to PKCS7 (.p7b)

Encrypt & Hash 7

echo -n "hello" | openssl md5

Compute an MD5 hash

echo -n "hello" | openssl sha256

Compute a SHA-256 hash

openssl dgst -sha256 file.txt

Compute a file's SHA-256

openssl enc -aes-256-cbc -in file.txt -out file.enc -pass pass:secret

AES-256-CBC encrypt a file

openssl enc -d -aes-256-cbc -in file.enc -out file.txt -pass pass:secret

AES-256-CBC decrypt a file

openssl rand -hex 32

Generate a 32-byte random hex string

openssl rand -base64 32

Generate a 32-byte random Base64 string

Command Examples

Check a remote certificate expiry

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

-servername sends SNI; without it you may be handed the default site certificate instead of the one you meant to inspect. The 2>/dev/null redirect drops the s_client handshake chatter so only the certificate body survives.

Output

notBefore=Aug 12 00:00:00 2026 GMT
notAfter=Nov 10 23:59:59 2026 GMT

Check which domains the certificate covers

openssl x509 -in cert.pem -ext subjectAltName -noout

SAN is the list browsers actually validate against, and the common names in the subject are no longer trusted by mainstream browsers. When a certificate is valid on paper yet the browser still complains, read this field first.

Output

X509v3 Subject Alternative Name:
    DNS:example.com, DNS:*.example.com, DNS:www.example.com

Generate a self-signed cert with SAN for local development

openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem \
  -days 365 -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,DNS:127.0.0.1"

-addext with subjectAltName is the part that matters: a self-signed certificate with no SAN is rejected outright by modern browsers and by Node.js. Put the loopback address in the SAN too, otherwise hitting the server by IP fails.

Output

Generating a RSA private key...
.+..........+
writing new private key to 'key.pem'

Verify a file SHA-256 checksum

openssl dgst -sha256 package.tar.gz
sha256sum -c package.tar.gz.sha256

Check the published checksum with sha256sum -c before unpacking anything you downloaded. openssl dgst computes the digest and sha256sum -c verifies it; the two are used as a pair on purpose.

Output

SHA2-256(package.tar.gz)= 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
package.tar.gz: OK

Common Pitfalls

Without -servername, openssl s_client may return the default site certificate, so the expiry you inspect may not be the host you are visiting.
Removing the passphrase (-nodes or rsa -out plain.key) makes the key readable by anyone who can read the file — chmod 600 any decrypted key.
Options that skip certificate verification enable man-in-the-middle attacks; use them only temporarily while debugging.
Self-signed certificates without a SAN are rejected by browsers and most runtimes — always generate with -addext subjectAltName.
An unrenewed certificate takes the whole site HTTPS down; monitor -dates output and alert before expiry.

Tips

Add -servername (SNI) when checking remote cert validity, or a multi-domain cert may return the default one.
Before a Let's Encrypt cert expires, use echo | openssl s_client to confirm the deployed cert actually renewed — don't trust file timestamps.
Add -nodes when converting PKCS12 to PEM, otherwise the exported key is passphrase-protected and Nginx/Traefik can't read it.

Official References

Each command links to its official documentation below, so you can verify the latest usage and read deeper.

OWASP

Maintained by LaoHand

Publicly updated on Jul 21, 2026, continuously proofread against official docs.

Contact Us

Wrong command or description? Send us corrections, business inquiries or product feedback by email.

Inspect Certificate 6

Remote Check 5

Generate Certificate 6

Private Key 5

Format Conversion 4

Encrypt & Hash 7

Command Examples

Check a remote certificate expiry

Check which domains the certificate covers

Generate a self-signed cert with SAN for local development

Verify a file SHA-256 checksum

Common Pitfalls

Tips

Related Cheatsheets

Share

Official References

Maintained by LaoHand

Contact Us