Essential OpenSSL Key Generation, CSR, TLS & Certificate Commands
Quick reference for creating private keys, generating Certificate Signing Requests (CSR), verifying X.509 expiration dates, and converting certificate formats.
Table of Contents
Key & CSR Generation Commands
Generating private keys and Certificate Signing Requests.
| Operation | Command Syntax | Description |
|---|---|---|
| Generate RSA Private Key | `openssl genrsa -out private.key 4096` | Creates high-security 4096-bit RSA private key. |
| Generate ECDSA Key | `openssl ecparam -name secp384r1 -genkey -out ec.key` | Generates modern elliptic curve key (faster and smaller than RSA). |
| Create CSR Request | `openssl req -new -key private.key -out domain.csr` | Generates certificate signing request for CA submission. |
| Self-Signed Certificate | `openssl req -x509 -newkey rsa:4096 -keyout k.pem -out c.pem -days 365 -nodes` | Creates 1-year self-signed TLS certificate for local dev. |
Inspecting Certificates & Expiration
Validating certificate properties and testing live TLS handshakes.
| Audit Task | Command Syntax | Output Information |
|---|---|---|
| Check Expiration Date | `openssl x509 -in cert.crt -noout -enddate` | Displays exact UTC expiration timestamp. |
| Inspect Full Details | `openssl x509 -in cert.crt -noout -text` | Prints Subject Alternative Names (SAN), issuer, and serial number. |
| Test Live Remote Server | `openssl s_client -connect example.com:443 -servername example.com` | Performs live TLS handshake and prints entire certificate chain. |
Interactive Client-Side Tools for this Guide
Test and run these patterns directly inside your browser with zero server uploads:
Online Hash Generator (MD5, SHA-256, SHA-512)
Compute message digests and cryptographic checksums using native Web Crypto API. 100% private and client-side.
Webhook HMAC Signature Generator & Verifier
Cryptographically sign and verify incoming webhook payloads with your secret key. Supports Stripe, GitHub, and Shopify standards with zero server uploads.
Protect & Encrypt PDF Online
Add tamper protection and security headers to confidential documents directly in your browser.
Frequently Asked Questions
What is the difference between PEM and DER format?
PEM is ASCII Base64 encoded text enclosed in "-----BEGIN CERTIFICATE-----" headers. DER is raw binary encoding. Use openssl x509 -in cert.pem -outform der -out cert.der to convert.
Why should modern projects use ECDSA over RSA?
ECDSA provides equivalent cryptographic strength with much smaller key lengths (256-bit ECDSA equals 3072-bit RSA), speeding up TLS handshakes on mobile devices.