openssl is a versatile tool for managing cryptographic operations, including generating keys, creating certificates, and securing communications. It supports SSL/TLS protocols, digital signatures, encryption, and more.
Generate a Self-Signed Certificate for Testing
Example Usage:
openssl req -x509 -new -nodes -days 365 -keyout key.pem -out cert.pem
What it does:
Creates a self-signed X.509 certificate valid for 365 days, with a private key stored in key.pem and the certificate in cert.pem.
Command-line Arguments Explained:
-x509: Specifies that the output should be a self-signed certificate.-new: Generates a new certificate request (CSR).-nodes: Prevents the private key from being encrypted (no DES).-days 365: Sets the certificate validity period to 365 days.-keyout key.pem: Writes the generated private key to key.pem.-out cert.pem: Saves the certificate output to cert.pem.
Test SSL/TLS Connections
Example Usage:
openssl s_client -connect example.com:443
What it does:
Establishes an SSL/TLS connection to a remote server (e.g., example.com:443) to inspect its certificate and protocol details.
Command-line Arguments Explained:
-connect: Specifies the host and port to connect to (e.g., example.com:443).-showcerts: Displays all certificates in the chain (optional, not in the example but adds context).
Generate a Private RSA Key
Example Usage:
openssl genrsa -out private_key.pem 2048
What it does:
Generates a 2048-bit RSA private key and saves it to private_key.pem.
Command-line Arguments Explained:
-out: Specifies the output file for the private key.2048: Sets the key length (in bits) for the RSA key.
Create a Certificate Signing Request (CSR)
Example Usage:
openssl req -new -key private_key.pem -out csr.pem
What it does:
Generates a CSR using an existing private key (private_key.pem), which is then submitted to a Certificate Authority (CA).
Command-line Arguments Explained:
-new: Creates a new CSR.-key: Specifies the private key file to use.-out: Saves the CSR to csr.pem.
View Certificate Details
Example Usage:
openssl x509 -in cert.pem -text -noout
What it does:
Displays the human-readable contents of a certificate file (cert.pem) without outputting the binary data.
Command-line Arguments Explained:
-in: Specifies the input certificate file.-text: Prints the certificate details in text format.-noout: Prevents the certificate from being output in binary form.
Example Usage:
openssl x509 -in cert.pem -outform DER -out cert.der
What it does:
Converts a PEM-formatted certificate to DER (binary) format and saves it as cert.der.
Command-line Arguments Explained:
-in: Input file in PEM format (cert.pem).-outform DER: Specifies the output format as DER (binary).-out: Saves the converted certificate to cert.der.
Sign a CSR with a Private Key
Example Usage:
openssl x509 -req -in csr.pem -CA ca_cert.pem -CAkey ca_key.pem -CAcreateserial -out signed_cert.pem
What it does:
Signs a CSR (csr.pem) using a CA's private key (ca_key.pem) and certificate (ca_cert.pem), outputting a signed certificate (signed_cert.pem).
Command-line Arguments Explained:
-req: Treats the input as a CSR.-in: Input CSR file (csr.pem).-CA: Path to the CA certificate.-CAkey: Path to the CA's private key.-CAcreateserial: Creates a serial file if it doesn't exist.-out: Saves the signed certificate.
Check a Certificate's Validity Period
Example Usage:
openssl x509 -in cert.pem -enddate -noout
What it does:
Displays the certificate's expiration date (end date).
Command-line Arguments Explained:
-in: Input certificate file (cert.pem).-enddate: Outputs the certificate's end date.-noout: Prevents the certificate from being output in binary.
Generate Diffie-Hellman Parameters
Example Usage:
openssl dhparam -out dhparam.pem 2048
What it does:
Creates DH parameters (used in TLS) for a 2048-bit key exchange, saving them to dhparam.pem.
Command-line Arguments Explained:
-out: Output file for DH parameters.2048: Key length in bits for DH parameters.
Convert PKCS#12 (PFX) Files to PEM
Example Usage:
openssl pkcs12 -in key_store.pfx -out key.pem -nodes
What it does:
Extracts a certificate and private key from a PKCS#12 (PFX) file (key_store.pfx) into PEM format, saving them to key.pem.
Command-line Arguments Explained:
-in: Input PKCS#12 file.-out: Output PEM file (contains certificate and private key).-nodes: Prevents password protection of the private key.
Check SSL/TLS Server Configuration
Example Usage:
openssl s_server -cert cert.pem -key private_key.pem -accept 443
What it does:
Starts an SSL/TLS server listening on port 443, using cert.pem and private_key.pem.
Command-line Arguments Explained:
-cert: Path to the server's certificate.-key: Path to the server's private key.-accept: Port to listen on (e.g., 443).
Generate a Hash (Digest) of a File
Example Usage:
openssl dgst -sha256 -out hash.txt file.txt
What it does:
Computes the SHA-256 hash of file.txt and saves it to hash.txt.
Command-line Arguments Explained:
-sha256: Specifies the hashing algorithm.-out: Output file for the hash result.file.txt: Input file to hash.
Encrypt a File Using AES-256
Example Usage:
openssl enc -aes-256-cbc -in input.txt -out encrypted.txt -pass pass:mysecretpassword
What it does:
Encrypts input.txt using AES-256-CBC with the provided password, saving the result to encrypted.txt.
Command-line Arguments Explained:
-aes-256-cbc: Specifies the encryption algorithm.-in: Input file to encrypt.-out: Output file for the encrypted data.-pass: Password for encryption (e.g., pass:mysecretpassword).
Decrypt a File Using AES-256
Example Usage:
openssl enc -d -aes-256-cbc -in encrypted.txt -out decrypted.txt -pass pass:mysecretpassword
What it does:
Decrypts encrypted.txt using AES-256-CBC and the provided password, saving the result to decrypted.txt.
Command-line Arguments Explained:
-d: Enables decryption mode.-aes-256-cbc: Encryption algorithm used during encryption.-in: Input file to decrypt.-out: Output file for the decrypted data.-pass: Password for decryption.
Create a Password-Protected Private Key
Example Usage:
openssl genrsa -aes256 -out secure_key.pem 2048
What it does:
Generates a 2048-bit RSA private key and encrypts it with AES-256, prompting for a password.
Command-line Arguments Explained:
-aes256: Encrypts the private key with AES-256.-out: Output file for the secured key.2048: Key length in bits.
Generate a Random String for Passwords
Example Usage:
openssl rand -base64 32
What it does:
Generates a 32-byte random string encoded in Base64, suitable for passwords or tokens.
Command-line Arguments Explained:
-base64: Outputs the random bytes in Base64 encoding.32: Number of random bytes to generate.
Verify a Certificate Against a CA
Example Usage:
openssl verify -CAfile ca_cert.pem cert.pem
What it does:
Verifies that cert.pem is signed by the CA certificate in ca_cert.pem.
Command-line Arguments Explained:
-CAfile: Path to the CA certificate used for verification.cert.pem: Certificate to verify.
Check Connection to a Secure Server
Example Usage:
openssl s_client -connect localhost:8443 -cert client_cert.pem -key client_key.pem
What it does:
Connects to a secure server on localhost:8443 using a client certificate and private key for mutual TLS authentication.
Command-line Arguments Explained:
-connect: Host and port to connect to.-cert: Path to the client certificate.-key: Path to the client private key.
Example Usage:
openssl x509 -in cert.pem -outform DER -out cert.der
What it does:
Converts a PEM-formatted certificate to DER (binary) format, saving it as cert.der.
Command-line Arguments Explained:
-in: Input file in PEM format.-outform DER: Specifies DER as the output format.-out: Output file for the converted certificate.
