OpenSSL Cheatsheet - OpenSSL Certificate & Encryption Reference
Anyone who has configured TLS has walked the same loop — generate, verify, deploy — and openssl has a command for each stage. The sheet is grouped by stage: inspecting a certificate file for subject, SAN and validity, checking the one a remote endpoint actually serves, generating self-signed certificates and CSRs, handling keys and their permissions, and converting between DER, PEM and PFX. The step people skip and then regret every quarter is the remote check. openssl s_client -connect host:443 -servername name must carry SNI, otherwise a multi-domain server returns its default site certificate and you wrongly conclude the certificate never rotated. The other frequent trap sits in format conversion: converting PKCS12 to PEM without -nodes produces an encrypted key that Nginx and Traefik cannot read, and the error points nowhere near the cause. The troubleshooting order matters: confirm the live certificate first, validate the local file second, and only then edit configuration.
Inspect Certificate 6
openssl x509 -in cert.pem -text -nooutopenssl x509 -in cert.pem -dates -nooutopenssl x509 -in cert.pem -issuer -nooutopenssl x509 -in cert.pem -subject -nooutopenssl x509 -in cert.pem -ext subjectAltName -nooutopenssl x509 -in cert.pem -fingerprint -sha256 -nooutRemote Check 5
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -datesecho | openssl s_client -connect example.com:443 -showcerts 2>/dev/nullecho | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -text -nooutopenssl s_client -connect example.com:443 -servername example.com -tls1_2openssl s_client -connect example.com:443 -servername example.com -tls1_3Generate Certificate 6
openssl genrsa -out private.key 2048openssl ecparam -genkey -name prime256v1 -out private.keyopenssl req -new -key private.key -out request.csropenssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csropenssl req -x509 -newkey rsa:2048 -nodes -keyout private.key -out cert.pem -days 365 -subj "/CN=localhost"openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,DNS:*.localhost"Private Key 5
openssl rsa -in private.key -check -nooutopenssl rsa -in encrypted.key -out plain.keyopenssl rsa -in plain.key -aes256 -out encrypted.keyopenssl rsa -in private.key -pubout -out public.keyopenssl pkey -in private.key -nooutFormat Conversion 4
openssl pkcs12 -export -out cert.p12 -inkey private.key -in cert.pemopenssl pkcs12 -in cert.p12 -out cert.pem -nodesopenssl pkcs12 -in cert.p12 -info -nooutopenssl crl2pkcs7 -nocrl -certfile cert.pem -out cert.p7bEncrypt & Hash 7
echo -n "hello" | openssl md5echo -n "hello" | openssl sha256openssl dgst -sha256 file.txtopenssl enc -aes-256-cbc -in file.txt -out file.enc -pass pass:secretopenssl enc -d -aes-256-cbc -in file.enc -out file.txt -pass pass:secretopenssl rand -hex 32openssl rand -base64 32Command Examples
Check a remote certificate expiry
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates-servername 是发送 SNI，不加的话可能拿到默认站点的证书。2>/dev/null 滤掉 s_client 的握手调试输出，只留证书内容。
Output
notBefore=Aug 12 00:00:00 2026 GMT notAfter=Nov 10 23:59:59 2026 GMT
Check which domains the certificate covers
openssl x509 -in cert.pem -ext subjectAltName -nooutSAN 才是浏览器实际校验的域名列表，CN 已不再被主流浏览器采信。排查「证书有效但浏览器报错」先看这里。
Output
X509v3 Subject Alternative Name:
DNS:example.com, DNS:*.example.com, DNS:www.example.comGenerate a self-signed cert with SAN for local development
openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem \
-days 365 -subj "/CN=localhost" \
-addext "subjectAltName=DNS:localhost,DNS:127.0.0.1"-addext 加 SAN 是关键：没有 SAN 的自签证书在现代浏览器和 Node.js 里都会直接判无效。127.0.0.1 也要写进 SAN，否则访问 IP 时报错。
Output
Generating a RSA private key... .+..........+ writing new private key to 'key.pem'
Verify a file SHA-256 checksum
openssl dgst -sha256 package.tar.gz
sha256sum -c package.tar.gz.sha256下载后先用 sha256sum -c 核对来源提供的校验和再解压。openssl dgst 计算，sha256sum -c 验证，两步配套使用。
Output
SHA2-256(package.tar.gz)= 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 package.tar.gz: OK
Common Pitfalls
- Without -servername, openssl s_client may return the default site certificate, so the expiry you inspect may not be the host you are visiting.
- Removing the passphrase (-nodes or rsa -out plain.key) makes the key readable by anyone who can read the file — chmod 600 any decrypted key.
- Options that skip certificate verification enable man-in-the-middle attacks; use them only temporarily while debugging.
- Self-signed certificates without a SAN are rejected by browsers and most runtimes — always generate with -addext subjectAltName.
- An unrenewed certificate takes the whole site HTTPS down; monitor -dates output and alert before expiry.
Tips
- Add -servername (SNI) when checking remote cert validity, or a multi-domain cert may return the default one.
- Before a Let's Encrypt cert expires, use echo | openssl s_client to confirm the deployed cert actually renewed — don't trust file timestamps.
- Add -nodes when converting PKCS12 to PEM, otherwise the exported key is passphrase-protected and Nginx/Traefik can't read it.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us