1. Home
2. /
3. TLS/SSL & S/MIME
4. /
5. OpenSSL - most common commands

OpenSSL - most common commands

5 min read

File extensions for TLS/SSL certificates

If you need a format other than Base64 encoded X.509 for your certificate, you can convert it to the desired format with a corresponding tool, such as the open source tool OpenSSL (Details about OpenSSL). The format that your certificate must have depends on the server on which it is to be installed.

The PEM format is the most commonly used format for certificates. File extensions for PEM certificates are .cer, .crt, and .pem. PEM certificates are Base64-encoded ASCII files. The DER format is the binary form of the certificate. DER-formatted certificates do not contain a BEGIN CERTIFICATE/END CERTIFICATE header and footer. DER-formatted certificates most commonly use the file extension .der.

OpenSSL commands

General OpenSSL commands

Commands for generating CSRs, Certificates, Private Keys and removing a passphrase from a private key

Generating a new private key and CSR

openssl req -new -nodes -keyout privatekey.key -out csr.csr -newkey rsa:2048

Generating a CSR for an existing private key

openssl req -out CSR.csr -key privatekey.key -new

Generating a certificate signing request based on an existing certificate

openssl x509 -x509toreq -in certificate.crt -out CSR.csr -signkey privatekey.key

Removing a passphrase from a private key

openssl rsa -in privateKey.pem -out newprivatekey.pem

Commands to read out information

If the certificate is password protected, this parameter can be used: -passin pass:“myPass”

Checking a Certificate Signing Request

openssl req -text -noout -verify -in CSR.csr

Reading out CSR

openssl req -in request.pem -noout -text

Checking a private key

openssl rsa -in privatekey.key -check

Checking a certificate

openssl x509 -in certificate.crt -text -noout

Checking a PKCS#12 file (.pfx or .p12)

openssl pkcs12 -info -in keyStore.p12

Reading out information from a .pem file

openssl x509 -noout -text -in cert.pem

Reading out Publickey from .pem file

openssl x509 -in cert.pem -pubkey

Reading out information from a .p12 file

openssl pkcs12 -info -in cert.p12

Reading out certificate from a .p12 file

openssl pkcs12 -in keystore.p12 -clcerts | openssl x509 -text

Reading out serial from .p12 file

openssl pkcs12 -in keystore.p12 -clcerts | openssl x509 -serial -noout

Reading out end date from .pkcs12 file

openssl pkcs12 -in cert.p12 -nodes | openssl x509 -noout -enddate

Displaying md5 fingerprint

openssl x509 -fingerprint -noout -md5 -in test.pem

Displaying SHA1 fingerprint

openssl x509 -fingerprint -noout -sha1 -in test.pem

Extracting private key and certificate from a PKCS#12 file (.pfx .p12)

openssl pkcs12 -in keyStore.pfx -out keyStore.pem -nodes

Do private key, CSR and the certificate match?

Checking an MD5 hash of the public key to ensure that it matches what is contained in a CSR or private key

openssl x509 -noout -modulus -in cert.crt | openssl md5 openssl rsa -noout -modulus -in key.pem | openssl md5 openssl req -noout -modulus -in CSR.csr | openssl md5

Checking a TLS/SSL connection. All certificates including the intermediates should be displayed

openssl s_client -connect www.example.com:443

Converting certificate files

If the certificate is required in an alternative format, this can be converted using the open source tool OpenSSL: OPEN SSL Converting Certificate Files. The required format depends on the server on which it is to be installed.

Certificate files

.cer to .pem

openssl x509 -in cert.cer -outform PEM -out cert.pem

.pem to .der

openssl x509 -outform der -in cert.pem -out cert.der

.pem to .p7b

openssl crl2pkcs7 -nocrl -certfile cert.pem -out cert.p7b -certfile intermediate.cer

The certificate (CRT) and the intermediate (CA CRT) are required to generate a .p7b file. The certificate is available in PEM format in the certificate details under CRT. The intermediate is displayed under CA CRT. Copy CRT and CA CRT (Intermediate) into a text editor and save the file as e.g. “Cert.pem”.

.p7b to .pem

openssl pkcs7 -print_certs -in cert.p7b -out cert.pem

.pfx to .pem

openssl pkcs12 -in cert.pfx -out cert.pem

It is highly recommended to convert to and from .pfx files on your own machine so you can keep the private key there.

.pem to .pfx / .p12

openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem -certfile intermediate.pem

The private key, the certificate (CRT) and the intermediate (CA CRT) are required to generate a PFX/PKCS#12 file. The certificate is available in PEM. format in the certificate details under CRT. The intermediate is displayed under CA CRT.

Step by step:

• Copy the data under CRT into a text editor and save the file as e.g. “cert.pem”.
• Repeat the process with the CA CRT (Intermediate) and save it as e.g. “intermediate.pem”.
• ey in the same directory and save it as e.g. “key.pem”.
• Open your terminal and execute the OpenSSL command in the folder in which the files are located.

As .pfx / .p12 contains the private key, a password must be entered for the conversion. This is required again if, for example, the private key is to be extracted from the PFX file.

s_client commands

-showcerts

Add the -showcerts parameter to this command to print all certificates in the certificate chain submitted by the SSL service. This may help to troubleshoot missing intermediate CA certificate problems.

openssl s_client -connect : -showcerts

-ssl2

Add this parameter to force OpenSSL to use SSLv2 only. This option is useful to test supported SSL protocol versions. For example, you can use this command to test whether SSLv2 is enabled or not. 

openssl s_client -connect : -ssl2

-ssl3,-tls1,-dtls1

Similar to -ssl2 switch -ssl3, -tls1 and -dtls1 force SSLv3, TLSv1 and DTLSv1 respectively. 

openssl s_client -connect : -ssl3 openssl s_client -connect : -tls1 openssl s_client -connect : -dtls1

-cipher 

With this parameter you can force a specific cipher. This option is useful for testing enabled SSL ciphers. For example, after disabling weak ciphers, you can test the connection with a disabled cipher to ensure that it was successfully disabled.

You can use the “openssl ciphers” command to display a list of the ciphers available for OpenSSL.

Using a cypher not supported by the server will result in an error similar to the following.

openssl s_client -connect : -cipher DHE-RSA-AES256-SHA openssl s_client -connect example.com:443 -cipher EXP-RC4-MD5 CONNECTED(00000003) 42792:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:/SourceCache/OpenSSL098/OpenSSL098-47.1/src/ssl/s23_clnt.c:602