SECURITY & CRYPTOGRAPHYCHEAT SHEET•6 min read•Intermediate••100% Client-Side Verified
OpenSSL Command Cheat Sheet: Generating Keys, CSRs & Inspecting Certificates
Complete OpenSSL CLI cheat sheet for DevOps and Sysadmins. Generate private keys, create Certificate Signing Requests (CSRs), verify SSL handshakes, and convert PEM to DER.
#OpenSSL#SSL#TLS#DevOps#Certificates#Linux
Interactive X.509 Certificate Decoder
Live Interactive Sandbox100% Client-Side
Inspect SANs, expiration dates, and public key fingerprints locally without server transmission. Test the preset input below or customize it before launching into the full workspace.
PEM Formatted Certificate:
Ready for advanced parsing, syntax error highlighting & bulk export?
Open in Full Workspace (Certificate Decoder)OpenSSL is the Swiss Army knife of transport layer security and cryptographic infrastructure. Whether configuring Nginx, Kubernetes ingress controllers, or AWS load balancers, these commands are daily necessities.
1. Generating Private Keys
Generate RSA 4096-bit Key
openssl genrsa -out server.key 4096
Generate Modern Ed25519 Key
openssl genpkey -algorithm ED25519 -out server_ed25519.key
2. Certificate Signing Requests (CSR)
Create a CSR from Existing Private Key
openssl req -new -key server.key -out server.csr \
-subj "/C=US/ST=California/L=San Francisco/O=DevScratchpad/CN=devscratchpad.tech"
Inspect CSR Details
openssl req -text -noout -verify -in server.csr
3. Inspecting Certificates
View Complete Certificate Information
openssl x509 -in cert.pem -text -noout
Check Only Validity Expiration Dates
openssl x509 -in cert.pem -noout -dates
Extract Subject Alternative Names (SANs)
openssl x509 -in cert.pem -noout -ext subjectAltName
4. Live Server SSL Handshake Debugging
Connect and Inspect Remote Certificate
openssl s_client -servername example.com -connect example.com:443
Quick Expiration Check for Remote Host
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
| openssl x509 -noout -enddate
Live Tool: X.509 Certificate & CSR Decoder
Client-Side EngineDecode X.509 PEM certificates and PKCS#10 CSRs in your browser. Inspect Subject, Issuer, SANs, Validity countdown, and fingerprints.
Frequently Asked Questions (FAQ)
Run: echo | openssl s_client -servername domain.com -connect domain.com:443 2>/dev/null | openssl x509 -noout -dates