Cheat sheet

OpenSSL

Inspect certificates, generate keys and CSRs, test TLS, and convert formats.

Inspect certificates

# Inspect a certificate file
openssl x509 -in cert.pem -text -noout

# Check expiry date only
openssl x509 -in cert.pem -noout -dates

# Check subject and issuer
openssl x509 -in cert.pem -noout -subject -issuer

# Check certificate fingerprint (SHA-256)
openssl x509 -in cert.pem -noout -fingerprint -sha256

# Inspect a remote server's certificate
openssl s_client -connect example.com:443 </dev/null 2>/dev/null \
  | openssl x509 -noout -text

# Check expiry of a remote certificate
openssl s_client -connect example.com:443 </dev/null 2>/dev/null \
  | openssl x509 -noout -dates

Generate keys & CSRs

# Generate RSA private key (4096-bit)
openssl genrsa -out private.key 4096

# Generate EC private key (P-256) — modern approach
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ec.key

# Generate CSR from existing key
openssl req -new -key private.key -out request.csr \
  -subj "/CN=example.com/O=My Org/C=US"

# Generate key + CSR in one step
openssl req -newkey rsa:4096 -keyout private.key -noenc \
  -out request.csr \
  -subj "/CN=example.com"

# Inspect a CSR
openssl req -in request.csr -text -noout

Self-signed certificates

# Self-signed cert (dev/testing)
openssl req -x509 -newkey rsa:4096 -keyout key.pem \
  -out cert.pem -sha256 -days 365 -noenc \
  -subj "/CN=localhost"

# Self-signed with SANs (Subject Alternative Names)
openssl req -x509 -newkey rsa:4096 -keyout key.pem \
  -out cert.pem -sha256 -days 365 -noenc \
  -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,DNS:*.local,IP:127.0.0.1"

# Sign a CSR with your own CA
openssl x509 -req -in request.csr \
  -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out cert.pem -days 365 -sha256

Verify & test

# Verify cert matches private key
openssl x509 -noout -modulus -in cert.pem | md5sum
openssl rsa -noout -modulus -in private.key | md5sum
# (outputs must match)

# Verify cert chain
openssl verify -CAfile ca.pem cert.pem

# Test TLS connection
openssl s_client -connect example.com:443

# Test with SNI (Server Name Indication)
openssl s_client -connect example.com:443 -servername example.com

# Test specific TLS version
openssl s_client -tls1_3 -connect example.com:443

# Check which cipher was negotiated
openssl s_client -connect example.com:443 </dev/null 2>/dev/null \
  | grep "Cipher is"

Format conversion

# PEM → DER (binary)
openssl x509 -in cert.pem -outform der -out cert.der

# DER → PEM
openssl x509 -in cert.der -inform der -out cert.pem

# PEM → PKCS#12 (.pfx / .p12)
openssl pkcs12 -export -out cert.pfx \
  -inkey private.key -in cert.pem -certfile ca.pem

# PKCS#12 → PEM
openssl pkcs12 -in cert.pfx -out cert.pem -noenc

# Extract just the certificate from PKCS#12
openssl pkcs12 -in cert.pfx -nokeys -out cert.pem

# Check if a .pfx is password-protected
openssl pkcs12 -info -in cert.pfx -noout

Hashing & encoding

# Hash a file (SHA-256)
openssl dgst -sha256 file.txt

# HMAC
openssl dgst -sha256 -hmac "secret" file.txt

# Base64 encode
openssl base64 -in file.bin -out file.b64

# Base64 decode
openssl base64 -d -in file.b64 -out file.bin

# Generate random bytes (hex)
openssl rand -hex 32

# Generate random base64 string (for secrets)
openssl rand -base64 32

About the OpenSSL cheat sheet

openssl is the tool you reach for when a certificate problem needs an answer rather than a guess. Most certificate incidents come down to three questions: what does this certificate actually say, does this private key match it, and what is the server really presenting.

The distinction between inspecting a file and inspecting a live endpoint matters. Reading a certificate from disk tells you what you have; connecting to a server tells you what it is serving, including the full chain it sends. Those differ more often than people expect — a correct certificate on disk that is not the one being served is a common and confusing failure.

Chain problems are the most frequent real-world issue. A server that sends its leaf certificate without the intermediate works in browsers, which cache intermediates, and fails in curl, Java clients and anything else that does not. Testing with a client that does not paper over it is how you catch this before users do.

Frequently asked questions

How do I check what a live server is presenting?

Connect with the client subcommand and read the certificate chain it returns, specifying the server name so the right virtual host is selected. This shows the full chain as served, which is what actually matters — a certificate that is correct on disk but not being served is a common cause of confusing failures.

How do I confirm a private key matches a certificate?

Derive the public key from each and compare them — extract the public key from the certificate and from the private key, and if the two differ they are not a pair. The older trick of comparing moduli works only for RSA; on an ECDSA certificate it errors out and tells you nothing, so the public-key comparison is the one worth remembering. This is the fastest way to diagnose a service that will not start with a TLS configuration error, which is very often a mismatched key and certificate rather than anything more subtle.

Why does my certificate work in a browser but not in curl?

Almost always a missing intermediate certificate. Browsers cache intermediates from previous connections and can fetch them, so a chain that is incomplete still works there. Other clients do not. Serve the full chain — leaf plus intermediates, without the root — and it will work everywhere.

What is the difference between PEM, DER, PKCS12 and JKS?

They are encodings and containers, not different certificates. PEM is base64 text with header lines and the most common on Linux. DER is the binary equivalent. PKCS12 bundles a certificate with its private key in one password-protected file, and is what Windows and Java tooling typically want. openssl converts between them, so a format mismatch is an inconvenience rather than a problem.

How do I check when a certificate expires?

Read the validity dates from the certificate, either from a file or from a live connection. For monitoring, check the live endpoint rather than a file on disk — the goal is to know what users are being served, and a renewed file that was never picked up by the running process is exactly the failure you are trying to catch.