OpenSSL Command Builder

Build OpenSSL commands interactively. Generate keys, create CSRs, test TLS connections, convert certificate formats, and more. All client-side.

command preview

Select an action below to start building your command|

Action

Key Generation

Certificates

Inspection

TLS Testing

Format Conversion

Encryption

Common Recipes

Ready-to-use OpenSSL commands. Click a card to load it into the builder, or copy directly. Click a recipe to populate the builder, or copy the command directly.

Click to load in builder

OpenSSL Reference

OpenSSL is the most widely used open-source toolkit for SSL/TLS and general-purpose cryptography. It powers certificate management, key generation, encryption, and TLS testing on virtually every Linux server. The openssl CLI is the Swiss Army knife of every DevOps engineer's toolkit.

Most Used OpenSSL Commands

Command	Purpose	Example
genpkey	Generate private key	openssl genpkey -algorithm RSA -out key.pem
req	Create CSR or self-signed cert	openssl req -new -key key.pem -out req.csr
x509	View/convert certificates	openssl x509 -in cert.pem -text -noout
s_client	Test TLS connections	openssl s_client -connect host:443
verify	Verify certificate chain	openssl verify -CAfile ca.pem cert.pem
pkcs12	Convert PFX/P12 files	openssl pkcs12 -in file.pfx -out file.pem
enc	Encrypt/decrypt files	openssl enc -aes-256-cbc -in file.txt
dhparam	Generate DH parameters	openssl dhparam -out dh.pem 2048

Certificate Workflow

Generate private key — openssl genpkey creates RSA or EC key
Create CSR — openssl req -new generates Certificate Signing Request
Submit to CA — Send CSR to Certificate Authority (Let's Encrypt, DigiCert, etc.)
Install certificate — Configure Nginx/Apache with cert + key + chain
Verify — openssl verify and s_client confirm everything works

RSA vs ECDSA vs Ed25519: Key Algorithm Comparison

Choosing the right key algorithm affects security, performance, and compatibility. Modern deployments should prefer ECDSA P-256 or Ed25519 for new certificates, while RSA 2048/4096 remains necessary for legacy compatibility.

Algorithm	Key Size	TLS Handshake	Compatibility	Generate Command
RSA 2048	2048 bit	Slowest	Universal	openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048
RSA 4096	4096 bit	Very slow	Universal	openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096
ECDSA P-256	256 bit	Fast	Wide (TLS 1.2+)	openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256
Ed25519	256 bit	Fastest	Limited (TLS 1.3)	openssl genpkey -algorithm ED25519

ECDSA P-256 offers the best balance: ~3x faster TLS handshakes than RSA 2048, smaller certificates, and broad browser support. Ed25519 is even faster but only works with TLS 1.3. RSA 4096 provides no meaningful security advantage over RSA 2048 for web certificates (both are considered safe until ~2030) but doubles handshake time.

Debugging TLS Connections with s_client

The openssl s_client command is the most important troubleshooting tool for TLS issues. It connects to a server, performs the TLS handshake, and shows the full certificate chain, protocol version, and cipher suite.

# Basic connection test (shows cert chain + handshake details)
openssl s_client -connect example.com:443 -servername example.com

# Test specific TLS version
openssl s_client -connect example.com:443 -tls1_2
openssl s_client -connect example.com:443 -tls1_3

# Check certificate expiry date
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -dates

# Show full certificate details
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -text

# Test with specific CA bundle (useful for internal CAs)
openssl s_client -connect internal.corp:443 -CAfile /etc/ssl/internal-ca.pem

# Check STARTTLS for email servers
openssl s_client -connect mail.example.com:587 -starttls smtp
openssl s_client -connect mail.example.com:993 -starttls imap

Key things to look for in the output: Verify return code: 0 (ok) means the chain is valid. Common errors include code 20 (unable to get local issuer certificate — missing intermediate CA), code 10 (certificate has expired), and code 18 (self-signed certificate).

Certificate Chain Explained

A TLS certificate chain (or chain of trust) connects your server's certificate to a trusted root CA through one or more intermediate certificates. When a browser connects, it verifies each link in the chain.

Root CA (in browser trust store)
 └── Intermediate CA (signed by Root)
      └── Server Certificate (signed by Intermediate)

# Verify a chain manually:
openssl verify -CAfile root-ca.pem -untrusted intermediate.pem server.pem

# Extract the chain from a live server:
openssl s_client -connect example.com:443 -showcerts 2>/dev/null \
  | awk '/BEGIN CERT/,/END CERT/{ print }'

# Build the correct bundle file (order matters!):
cat server.pem intermediate.pem > fullchain.pem

The most common TLS misconfiguration is a missing intermediate certificate. Desktop browsers often cache intermediates and work fine, while mobile clients and API consumers fail with "unable to verify the first certificate." Always serve the full chain.

Common Certificate Format Conversions

From	To	Command
PEM	DER	openssl x509 -in cert.pem -outform DER -out cert.der
DER	PEM	openssl x509 -in cert.der -inform DER -outform PEM -out cert.pem
PEM	PKCS#12	openssl pkcs12 -export -in cert.pem -inkey key.pem -out bundle.pfx
PKCS#12	PEM	openssl pkcs12 -in bundle.pfx -out all.pem -nodes
PEM key	PKCS#8	openssl pkcs8 -topk8 -in key.pem -out key-pkcs8.pem -nocrypt
PKCS#7	PEM	openssl pkcs7 -in chain.p7b -print_certs -out chain.pem

Common Certificate Formats

Format	Extension	Encoding	Used By
PEM	.pem, .crt, .key	Base64 (ASCII)	Linux, Nginx, Apache
DER	.der, .cer	Binary	Java, Windows, Android
PKCS#12	.pfx, .p12	Binary (encrypted)	Windows/IIS, macOS, S/MIME
PKCS#7	.p7b, .p7c	Base64 or Binary	Windows, Java (cert chain only)
PKCS#8	.p8, .key	PEM or DER	Modern private key format

Troubleshooting Common OpenSSL Errors

Error	Cause	Fix
unable to get local issuer certificate	Missing intermediate CA in chain	Add intermediate cert to fullchain bundle
certificate has expired	Cert or CA cert past validity	Renew certificate, check intermediate expiry
key values mismatch	Private key doesn't match certificate	Compare modulus: `openssl x509 -modulus` vs `openssl rsa -modulus`
self signed certificate	Root CA not in trust store	Add CA cert to system trust store or use `-CAfile`
wrong version number	Connecting to non-TLS port or HTTP	Check port number, try `-starttls` for SMTP/IMAP
hostname mismatch	SNI name differs from CN/SAN	Use `-servername` flag to set SNI

Creating SAN Certificates (Subject Alternative Names)

Modern browsers require Subject Alternative Names (SANs) — certificates using only the Common Name (CN) field are rejected by Chrome since 2017. Multi-domain and wildcard certificates must include all hostnames as SANs.

# Generate a self-signed cert with multiple SANs (one-liner)
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com,DNS:api.example.com"

# Create a CSR with SANs using a config file
cat > san.cnf << 'EOF'
[req]
distinguished_name = req_dn
req_extensions = v3_req
prompt = no

[req_dn]
CN = example.com
O = My Company
C = US

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = example.com
DNS.2 = *.example.com
DNS.3 = api.internal.example.com
IP.1 = 10.0.0.1
EOF

openssl req -new -key key.pem -out req.csr -config san.cnf

# Verify SANs in existing cert or CSR
openssl x509 -in cert.pem -noout -ext subjectAltName
openssl req -in req.csr -noout -text | grep -A1 "Subject Alternative Name"

The -addext flag (OpenSSL 1.1.1+) simplifies one-off certs. For production CSRs, use a config file — it's easier to review, version-control, and reuse during renewals.

Mutual TLS (mTLS) — Client Certificates

Mutual TLS authenticates both client and server. It's used in zero-trust architectures, service meshes (Istio, Linkerd), and API authentication. Here's a complete mTLS setup workflow:

# 1. Create a private CA
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ca-key.pem
openssl req -new -x509 -key ca-key.pem -out ca-cert.pem -days 3650 \
  -subj "/CN=Internal CA/O=My Org"

# 2. Generate server certificate (signed by CA)
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out server-key.pem
openssl req -new -key server-key.pem -out server.csr -subj "/CN=api.internal"
openssl x509 -req -in server.csr -CA ca-cert.pem -CAkey ca-key.pem \
  -CAcreateserial -out server-cert.pem -days 365

# 3. Generate client certificate (signed by same CA)
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out client-key.pem
openssl req -new -key client-key.pem -out client.csr -subj "/CN=service-a"
openssl x509 -req -in client.csr -CA ca-cert.pem -CAkey ca-key.pem \
  -CAcreateserial -out client-cert.pem -days 365

# 4. Test the mTLS connection
openssl s_client -connect api.internal:443 \
  -cert client-cert.pem -key client-key.pem -CAfile ca-cert.pem

The server verifies the client certificate against the CA, and the client verifies the server certificate against the same (or different) CA. Both sides reject connections from untrusted certificates.

OpenSSL Quick Reference Cheat Sheet

Task	Command
Generate RSA 2048 key	openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out key.pem
Generate EC P-256 key	openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out key.pem
Create CSR	openssl req -new -key key.pem -out req.csr
Self-signed cert (1 year)	openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
View certificate	openssl x509 -in cert.pem -text -noout
Check expiry date	openssl x509 -in cert.pem -noout -enddate
Check remote cert	openssl s_client -connect host:443 -servername host 2>/dev/null \| openssl x509 -noout -dates
Verify key matches cert	diff <(openssl x509 -modulus -in cert.pem) <(openssl rsa -modulus -in key.pem)
PEM to PFX	openssl pkcs12 -export -in cert.pem -inkey key.pem -out bundle.pfx
PFX to PEM	openssl pkcs12 -in bundle.pfx -out all.pem -nodes
Encrypt a file	openssl enc -aes-256-cbc -salt -pbkdf2 -in file.txt -out file.enc
Generate DH params	openssl dhparam -out dhparam.pem 2048
Test TLS connection	openssl s_client -connect host:443 -servername host
Check SMTP STARTTLS	openssl s_client -connect mail.example.com:587 -starttls smtp

OpenSSL 3.x vs 1.1.x Changes

OpenSSL 3.0 (released September 2021) introduced significant changes. The provider-based architecture replaced the legacy ENGINE API. Key differences for daily use:

Deprecated commands: openssl genrsa and openssl ecparam -genkey still work but prefer openssl genpkey
FIPS module: OpenSSL 3.x has a standalone FIPS provider — enable with -provider fips
Legacy algorithms: MD4, RC4, DES disabled by default. Re-enable with -provider legacy if needed
PKCS#12 encryption: 3.x defaults to AES-256-CBC (was RC2/3DES in 1.1.x). Use -legacy for compatibility with older tools

Privacy First

All command building happens in your browser. Your hostnames, file paths, organization details, and certificate information are never sent to any server.