/cheatsheets/openssl/openssl-cheat-sheet
OpenSSL cheat sheet: keys, CSRs, certificates and TLS checks
verified onenvironmentlocal · windows 10.0.26200 arm64 · GNU bash 5.3.15 (Git Bash) · OpenSSL 3.5.7 9 Jun 2026 (Library: OpenSSL 3.5.7 9 Jun 2026)updated 2026-10-20
- tool
- OpenSSL
- versions
- OpenSSL 3.x
- os
- linux, macos, windows
The OpenSSL commands you need for everyday certificate work, grouped by task.
Key, CSR and certificate in practice
openssl genpkey -algorithm ed25519 -out key.pem
openssl req -new -key key.pem -subj "/CN=api.example.test" -out req.csr
openssl req -in req.csr -noout -subject
openssl req -x509 -key key.pem -in req.csr -days 30 -out cert.pem 2>/dev/null
openssl x509 -in cert.pem -noout -subject -issuer
echo "key matches cert: $( [ "$(openssl pkey -in key.pem -pubout)" = "$(openssl x509 -in cert.pem -noout -pubkey)" ] && echo yes || echo no )"Output
subject=CN=api.example.test subject=CN=api.example.test issuer=CN=api.example.test key matches cert: yes
Keys
| Task | Command |
|---|---|
| EC P-256 key | openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out key.pem |
| RSA 3072 key | openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out key.pem |
| Ed25519 key | openssl genpkey -algorithm ed25519 -out key.pem |
| Public key from private | openssl pkey -in key.pem -pubout -out pub.pem |
| Remove a passphrase | openssl pkey -in enc.pem -out plain.pem |
Certificates and CSRs
| Task | Command |
|---|---|
| CSR with SAN | openssl req -new -key key.pem -subj "/CN=host" -addext "subjectAltName=DNS:host" -out req.csr |
| Inspect a certificate | openssl x509 -in cert.pem -noout -text |
| Subject, issuer, dates | openssl x509 -in cert.pem -noout -subject -issuer -dates |
| Expires within 30 days? | openssl x509 -in cert.pem -noout -checkend 2592000 |
| SHA-256 fingerprint | openssl x509 -in cert.pem -noout -fingerprint -sha256 |
| Verify against a CA | openssl verify -CAfile ca.pem cert.pem |
Conversions
| From → to | Command |
|---|---|
| PEM → DER | openssl x509 -in cert.pem -outform DER -out cert.der |
| DER → PEM | openssl x509 -in cert.der -inform DER -out cert.pem |
| PEM key + cert → PFX/P12 | openssl pkcs12 -export -inkey key.pem -in cert.pem -out bundle.pfx |
| PFX → PEM | openssl pkcs12 -in bundle.pfx -nodes -out all.pem |
Test a TLS server
| Task | Command |
|---|---|
| Handshake summary | openssl s_client -connect host:443 -servername host -brief </dev/null |
| Full chain | openssl s_client -connect host:443 -servername host -showcerts </dev/null |
| Force TLS 1.2 | openssl s_client -connect host:443 -tls1_2 </dev/null |
Sources
Related pages
commands · opensslopenssl req -x509: create a self-signed certificateCreate a self-signed certificate and key in one step with openssl req -x509 -newkey ec -nodes -keyout key.pem -out cert.pem -days 365, plus -subj and SAN.flags · opensslopenssl s_client -servername: test TLS with SNIopenssl s_client -connect host:443 -servername host sends SNI so the server returns the right certificate. Add -brief for a summary or -showcerts for the chain.codes · opensslOpenSSL verify error codes: 2, 10, 18, 19, 20, 21, 62OpenSSL X509 verify errors explained: 10 certificate has expired, 18 self-signed, 19 self-signed in chain, 20 unable to get local issuer, 62 hostname mismatch.