openssl howto

This is a very simple openssl howto. I made it mainly because I'm usually too lazy to remember how to create a key and a CSR (certificate signing request). Here are the commands to get a key and a CSR file:

Create a password-protected key:

openssl genpkey -out domainname.key -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -aes-128-cbc -pass pass:hello

Or one without a password:

openssl genpkey -out domainname.key -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:2048

Create the signing request. Enter the URL or email address in the CN (Common Name) field:

openssl req -new -key domainname.key -out domainname.csr

Verify your input:

openssl req -noout -text -in domainname.csr

Here is another example of how to create a self-signed cert with one command:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout mycert.pem -out mycert.pem

When you get a certificate, you'll probably want to check what's in it:

openssl x509 -text -in cert.pem

Some applications need the certificate's fingerprint. Here are two variants, for MD5 and SHA-1 fingerprints:

openssl x509 -md5 -fingerprint -in cert.pem
openssl x509 -sha1 -fingerprint -in cert.pem

If your key is password-protected and you don't want to enter the passphrase every time a daemon starts, you can unlock it with the following command:

openssl rsa -in certin.pem -out certout.pem

To check whether a key and a cert belong together, you can start openssl's built-in web server like this:

openssl s_server -key www.key -cert www.crt -www

You can then connect to that server with HTTPS on port 4433.

To test a remote certificate, you can use openssl's built-in client:

openssl s_client -connect www.example.com:443 -showcerts -CApath /etc/ssl/certs/  # HTTPS
openssl s_client -connect www.example.com:465 -showcerts -CApath /etc/ssl/certs/  # SMTPS
openssl s_client -connect www.example.com:995 -showcerts -CApath /etc/ssl/certs/  # POP3S

openssl s_client -connect www.example.com:25 -starttls smtp -showcerts -CApath /etc/ssl/certs/  # STARTTLS over SMTP

Sometimes you have to deal with PKCS#12 certificate files, which can be converted to and from PEM format. The first line converts PEM to PKCS#12, the second line does the opposite (PKCS#12 files sometimes have the extension .pfx and sometimes .p12):

openssl pkcs12 -export -out mycert.p12 -in mycert.pem -name "Certificate"
openssl pkcs12 -in mycert.p12 -out mycert.pem -nodes