🔐 OpenSSL Helper

A comprehensive reference guide for common OpenSSL commands used in SSL/TLS certificate management, key generation, and encryption tasks. Search for commands by keyword to find exactly what you need.

25 commands available

💡 Tip: Try searching for keywords like "csr", "key", "pem", "verify", "convert", "encrypt", or "self-signed" to find relevant commands.

Generate CSR + RSA Key (2048-bit) openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.csr

Generate RSA Key Only (2048-bit) openssl genrsa -out key.pem 2048

Generate 4096-bit RSA Key openssl genrsa -out key.pem 4096

Generate EC Private Key (P-256) openssl ecparam -genkey -name prime256v1 -out ec.key

Generate CSR with Existing Key openssl req -new -key key.pem -out req.csr

View Certificate Details (PEM) openssl x509 -in cert.pem -text -noout

Decode CSR Details openssl req -in req.csr -noout -text

Show Certificate Fingerprint (SHA-256) openssl x509 -in cert.pem -noout -fingerprint -sha256

Show Certificate Serial Number openssl x509 -in cert.pem -noout -serial

Check Certificate Expiration Date openssl x509 -enddate -noout -in cert.pem

Show Certificate Issuer openssl x509 -in cert.pem -noout -issuer

Check Key Matches Certificate openssl rsa -noout -modulus -in priv.key | openssl md5

Compare CSR and Key Modulus openssl req -noout -modulus -in req.csr | openssl md5

Compare Certificate and Key Modulus openssl x509 -noout -modulus -in cert.pem | openssl md5

Extract Public Key from Certificate openssl x509 -in cert.pem -pubkey -noout

Convert PEM to DER Format openssl x509 -in cert.pem -outform der -out cert.der

Convert DER to PEM Format openssl x509 -in cert.der -inform der -out cert.pem

Convert PEM to PKCS#12 (.pfx) openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem

Convert PKCS#12 (.pfx) to PEM openssl pkcs12 -in file.pfx -out file.pem -nodes

Convert PEM to PKCS#8 (unencrypted) openssl pkcs8 -topk8 -inform PEM -outform PEM -in key.pem -out pkcs8.key -nocrypt

Verify Certificate with CA openssl verify -CAfile ca.pem cert.pem

Test SSL Connection (s_client) openssl s_client -connect google.com:443

Bundle Certificate + Chain cat cert.pem chain.pem > fullchain.pem

Create Self-Signed Certificate (365 days) openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem

Encrypt File with AES-256-CBC openssl enc -aes-256-cbc -salt -in file.txt -out file.enc

Decrypt File openssl enc -aes-256-cbc -d -in file.enc -out file.txt

Generate Random Password (32 bytes, Base64) openssl rand -base64 32

A list, not a runner

Nothing executes here and nothing is uploaded: the page is static HTML holding 27 commands, and the box filters them. The filter matches a hidden keyword attribute rather than the visible title or the command itself, which explains two oddities. Searching pkcs12 returns nothing - that entry is tagged pfx - and x509 returns nothing either, so search by task words like convert, verify, modulus or self-signed. The counter also reads 25 until you type, then corrects itself to 27.

Three entries that need a caveat

The modulus checks only mean something in pairs. One hash on its own tells you nothing; run the key and the certificate versions and compare the two MD5 lines. They also work on RSA only - openssl rsa refuses an EC key, where you match openssl pkey -in key.pem -pubout against openssl x509 -in cert.pem -pubkey -noout instead.
PKCS#12 to PEM with -nodes writes your private key in clear into the same file as the certificates. Give that file 0600 and split it before it goes anywhere.
openssl enc as listed uses the legacy key derivation and adds no integrity check. Use openssl enc -aes-256-cbc -pbkdf2 -iter 600000 -salt -in file.txt -out file.enc, and remember CBC hides content without detecting tampering.

Frequently asked questions

How do I check a private key matches a certificate?

Run openssl rsa -noout -modulus -in priv.key | openssl md5 and openssl x509 -noout -modulus -in cert.pem | openssl md5. Identical output means they are a pair; different output means the certificate belongs to another key and the server will not start.

What is the difference between PEM, DER and PFX files?

DER is one object in raw binary. PEM is that binary base64-encoded with BEGIN and END lines, so several objects can sit in one text file. PFX, properly PKCS#12, is a single password-protected binary bundle carrying the private key, the certificate and its chain together - the format Windows and Java expect.

Why does s_client not show the right certificate?

You are probably hitting an IP address or a shared host without SNI. Add the name explicitly: openssl s_client -connect 1.2.3.4:443 -servername example.com.