OpenSSL Commands

The most tasks can be done using the gen-webserver-key.pl perl script. This creates all wannted files to request a certificate or to create a self signed certificate.

The usage is very simple:

Just execute perl gen-webserver-key.pl --help:

gen-webserver-key.pl     --host|-h <short host name> [ --privat|-p ] [ --bits|-k <bits for the key (512, 1024, 2048, 4096)> ]
            [ --sha|-s <SHA value> ] [ --java|-j ] [ --interactive|-i ] [ --verbose|-v ] [ --preview ] [ --email|-e ]

or
    
    gen-webserver-key.pl --useold|-o  <host name> [ -p ]
    gen-webserver-key.pl --viewcsr    <host name>
    gen-webserver-key.pl --viewkey    <host name>
    gen-webserver-key.pl --viewcrt    <host name>
    gen-webserver-key.pl --privat     <host name> [ --java ]
    gen-webserver-key.pl --cisco      <host name> [ --rootca <root certificate> ] [ --interca <intermediate certificate> ]
    gen-webserver-key.pl --ldap       <host name> [ --privat ]
    gen-webserver-key.pl --cacert     <host name>
    gen-webserver-key.pl --pemca      <host name>
    gen-webserver-key.pl --domain|-d  <new domain name>
    gen-webserver-key.pl --combine    <host name>
    gen-webserver-key.pl --convert|-c <cer/crt binary certificate file>
--viewcrt            => Just view the content of signed certificate
--viewkey            => Just view the content of ssl key file
--viewcrs            => Just view the content of the unsigned server certificate
--useold             => Generate a privat cert or official cert request using the old key
--privat <host name> => just creates a privat certification from existing privat key, if -p option given, the cert is privat!
--domain <domain>    => overwrites the example.com default
--java               => generates the PKCS12 encoded file for java keystores
--interactive        => enables interactive mode, password and all certificate request data must be entered
--cisco              => Generate the CISCO specific PKCS12 file, you must first generate the certificate request
--ldap               => Creates the need certs for ldap server setup (in PEM format)
--cacert             => Creates the cacert after cert request (needed, if not a privat certificat was requested for PEM, ldap)
--pemca              => Creates the pem CA certificate file for openssl connections (opensll s_client ...), only for private certs!
--combine            => Just combines the crt (PEM) and the key file to one chain.pem file.
-k                   => Default is '2048'
--sha                => SHA encryption algorithm, default is (sha1), possible values [sha sha1 sha224 sha256 sha384 sha512].

Note:   Password for all certs is 'password'
Note: For F5 certificates, standard key and crt (PEM) are OK, the password is 'password' to load it in F5

Important note: Beginning from 2016 the certificate requests must be encrypted with sha256 algorithm, see the --sha option in script!

openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.crt

openssl req -out CSR.csr -key privateKey.key -new

openssl x509 -x509toreq -in certificate.crt -out CSR.csr -signkey privateKey.key

openssl rsa -in privateKey.pem -out newPrivateKey.pem

If you need to check the information within a Certificate, CSR or Private Key, use these commands. You can also check CSRs and check certificates using our online tools.

openssl req -text -noout -verify -in CSR.csr

openssl rsa -in privateKey.key -check

openssl x509 -in certificate.crt -text -noout

openssl pkcs12 -info -in keyStore.p12

openssl s_client -host <hostname or IP> -port <portnumber> 2>/dev/null| openssl x509 -noout -dates

If you are receiving an error that the private doesn't match the certificate or that a certificate that you installed to a site is not trusted, try one of these commands. If you are trying to verify that an SSL certificate is installed correctly, be sure to check out the SSL Checker.

openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl rsa -noout -modulus -in privateKey.key | openssl md5
openssl req -noout -modulus -in CSR.csr | openssl md5

openssl s_client -connect www.paypal.com:443

These commands allow you to convert certificates and keys to different formats to make them compatible with specific types of servers or software. For example, you can convert a normal PEM file that would work with Apache to a PFX (PKCS#12) file and use it with Tomcat or IIS. Use our SSL Converter to convert certificates without messing with OpenSSL.

openssl x509 -inform der -in certificate.cer -out certificate.pem

openssl x509 -outform der -in certificate.pem -out certificate.der

openssl pkcs12 -in keyStore.pfx -out keyStore.pem -nodes

You can add -nocerts to only output the private key or add -nokeys to only output the certificates.

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt