Display complete certificate
openssl x509 -noout -text -in <certificate_name.crt>
Display the issuer of the certificate
openssl x509 -noout -issuer -in <certificate_name.crt>
For whom was the certificate issued?
openssl x509 -noout -subject -in <certificate_name.crt>
For which period is the certificate valid?
openssl x509 -noout -dates -in <certificate_name.crt>
echo QUIT | openssl s_client -connect host:443 2>/dev/null | sed -ne '/BEGIN CERT/,/END CERT/p' | openssl x509 -noout -text | grep -A2 Validity
Display the above combined
openssl x509 -noout -issuer -subject -dates -in <certificate_name.crt>
Display the hash
openssl x509 -noout -hash -in <certificate_name.crt>
Display the MD5 fingerprint
openssl x509 -noout -fingerprint -in <certificate_name.crt>
Verify an SSL certificate
openssl verify -CApath /etc/pki/tls/certs -verbose <certificate_name.crt>
Query an SSL port for certificates
openssl s_client -CApath /etc/pki/tls/certs -connect localhost:636 -showcerts
openssl s_client -connect host:443
printf '' | timeout 20 openssl s_client -starttls smtp -connect "host:25"
Extract server key from pfx (PKCS#12)
openssl pkcs12 -in certname.pfx -nocerts -out key.pem -nodes # extract key
openssl pkcs12 -in certname.pfx -nokeys -out cert.pem # export cert
openssl rsa -in key.pem -out server.key # remove passphrase
echo | openssl s_client -showcerts -connect www.google.ch:443`
-----BEGIN CERTIFICATE-----
MIIDfTCCAuagAwIBAgIDErvmMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT
... SERVER CERT ...
b8ravHNjkOR/ez4iyz0H7V84dJzjA1BOoa+Y7mHyhD8S
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDfTCCAuagAwIBAgIDErvmMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT
... INTERMEDIATE CERT ...
b8ravHNjkOR/ez4iyz0H7V84dJzjA1BOoa+Y7mHyhD8S
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDfTCCAuagAwIBAgIDErvmMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT
... ROOT CA CERT ...
b8ravHNjkOR/ez4iyz0H7V84dJzjA1BOoa+Y7mHyhD8S
-----END CERTIFICATE-----
openssl rsa -in <certificate_name.key> -out <newkeyfile.key>
openssl rsa -des3 -in <certificate_name.key> -out <newkeyfile.key>
<certificate_name.csr> is then sent to the certifying authority, e.g. Thawte etc.
openssl genrsa -out <certificate_name.key> 2048
openssl req -new -key <certificate_name.key> -out <certificate_name.csr>
openssl rsa -des3 -in <certificate_name.key> -out <certificate_name.key.sec>
openssl req -noout -text -in <request.csr>`
mkdir /root/certificate
chmod 700 /root/certificate
cd /root/certificate
CSR_C=CH
CSR_ST=St_Gall
CSR_L=Flawil
CSR_O=BITBULL
CSR_OU=IT
CSR_FQDN=$(hostname -f)
echo "
[req]
req_extensions = v3_req
default_bits = 4096
prompt = no
default_md = sha256
distinguished_name = req_distinguished_name
req_extensions = v3_req
[req_distinguished_name]
C = $CSR_C
ST = $CSR_ST
L = $CSR_L
O = $CSR_O
OU = $CSR_OU
CN = $CSR_FQDN
[v3_req]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
subjectAltName = @alt_names
[alt_names]
DNS.1 = $CSR_FQDN
" > $CSR_FQDN.cnf
# generate csr and encrypted private key
openssl req -new -out $CSR_FQDN.csr -keyout ${CSR_FQDN}_key.pem -config $CSR_FQDN.cnf
# generate csr and plain private key
openssl req -new -nodes -out $CSR_FQDN.csr -keyout ${CSR_FQDN}_key.pem -config $CSR_FQDN.cnf
# verify csr
openssl req -text -noout -verify -in $CSR_FQDN.csr
PEM to DER
openssl x509 -outform der -in certificate.pem -out certificate.der
PEM to P7B
openssl crl2pkcs7 -nocrl -certfile certificate.cer -out certificate.p7b -certfile CACert.cer
PEM to PFX
openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt
DER to PEM
openssl x509 -inform der -in certificate.cer -out certificate.pem
P7B to PEM
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
P7B to PFX
openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer
openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.cer
PFX to PEM
openssl pkcs12 -in certificate.pfx -out certificate.cer -nodes