Cheat Sheets Security

OpenSSL Commands Cheat Sheet

The OpenSSL commands people actually use: hashes and random bytes, keys, certificate requests, reading certificates, converting formats and testing a server. Each one was run against OpenSSL 3.5.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

OpenSSL is a command-line toolkit for hashing, encryption, keys and certificates. Every command below was run against OpenSSL 3.5. For a quick look at a certificate without the command line, use the Certificate Decoder or the SSL Certificate Checker; for digests in the browser, the Hash Generator.

Hashes, random data and encryption

Task Command
Show the version openssl version
SHA-256 of a file openssl dgst -sha256 file.txt
SHA-384 digest as Base64 (for SRI) openssl dgst -sha384 -binary file.js | openssl base64 -A
32 random bytes as hex openssl rand -hex 32
24 random bytes as Base64 openssl rand -base64 24
Encrypt a file with a passphrase openssl enc -aes-256-cbc -pbkdf2 -salt -in f.txt -out f.enc
Decrypt it again openssl enc -d -aes-256-cbc -pbkdf2 -in f.enc -out f.txt
Hash a password for /etc/shadow (SHA-512 crypt) openssl passwd -6 -salt abcdefgh secret

Keys and certificate requests

Task Command
RSA private key, 2048 bits openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out key.pem
Elliptic-curve key (P-256) openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ec.pem
Extract the public key openssl pkey -in key.pem -pubout -out pub.pem
Describe a key openssl pkey -in ec.pem -noout -text
List the available curves openssl ecparam -list_curves
Certificate signing request (CSR) openssl req -new -key key.pem -subj "/CN=example.com" -out req.csr
Read a CSR openssl req -in req.csr -noout -subject
Self-signed certificate for 365 days, with SANs openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Reading and converting certificates

Task Command
Subject, issuer and validity dates openssl x509 -in cert.pem -noout -subject -issuer -dates
SHA-256 fingerprint openssl x509 -in cert.pem -noout -fingerprint -sha256
Subject Alternative Names openssl x509 -in cert.pem -noout -ext subjectAltName
Everything, decoded openssl x509 -in cert.pem -noout -text
PEM to DER openssl x509 -in cert.pem -outform der -out cert.der
DER to PEM openssl x509 -inform der -in cert.der -out cert.pem
Check a certificate against a CA file openssl verify -CAfile ca.pem cert.pem
Does the key match the certificate? (compare the two hashes) openssl x509 -in cert.pem -noout -pubkey | openssl sha256 and openssl pkey -in key.pem -pubout | openssl sha256
Bundle a key and certificate as PKCS#12 openssl pkcs12 -export -in cert.pem -inkey key.pem -out bundle.p12
Inspect a PKCS#12 bundle openssl pkcs12 -info -in bundle.p12 -noout
Fetch and read the certificate a server presents openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -subject -dates
Test a specific TLS version openssl s_client -connect example.com:443 -tls1_3

Good to know

  • -pbkdf2 makes enc derive its key with PBKDF2 instead of the weak legacy method; always include it.
  • -nodes ("no DES") leaves the private key unencrypted on disk. Use it only for throwaway or test keys.
  • Passing a passphrase on the command line (-pass pass:...) exposes it in the process list. Prefer -pass stdin or a file.
  • The -servername option sets SNI. Without it, a server hosting several sites may present the wrong certificate.
  • A digest piped through openssl base64 -A is what a SRI Hash Generator produces for the integrity attribute.

Try these tools

Certificate Decoder

Decode X.509 certificates and certificate signing requests (CSRs) in your browser: subject, issuer, validity, serial, public key.

SSL Certificate Checker

Check any domain's SSL/TLS certificate details server-side — issuer, subject, expiry date, and SAN list.

Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text, computed locally with the Web Crypto API.

SRI Hash Generator

Generate Subresource Integrity (SRI) hashes for a script or stylesheet.

Key Pair Generator

Create Ed25519, ECDSA (P-256, P-384) or RSA (2048-4096) key pairs with Web Crypto and export them as PEM (SPKI and PKCS#8) and as an.

See also

  • Cheat sheet Hash and Cipher Algorithms Cheat Sheet
    Digest sizes of MD5, SHA-1, SHA-2, SHA-3 and BLAKE2, key and block sizes of AES, ChaCha20 and 3DES.
  • Guide How HTTPS and TLS Work
    How the TLS 1.3 handshake, key exchange and certificate chain make a connection private and authenticated.
  • Guide How Hashing Works
    What a hash function does, the avalanche effect shown with real SHA-256 output, which algorithms are still safe, HMAC.
  • Glossary Digital certificate
    A digital certificate is a signed file that links a public key to an identity, such as a domain name, so others can trust that key.
  • Glossary TLS
    TLS (Transport Layer Security) is the cryptographic protocol that encrypts and authenticates connections, including HTTPS, email and VPNs.
Back to the cheat sheets
AdSense Placeholder
Slot: footer_leaderboard