Protocols & Standards

OpenSSL Cheat Sheet: The Commands That Cover Certificate Work

OpenSSL is the Swiss army knife of certificate work, and a handful of commands cover nearly everything: decoding certificates and CSRs, generating keys and requests, converting formats, verifying chains and inspecting live servers. This cheat sheet collects the commands worth memorizing — each with the online tool that does the same job without flags.

Inspect and decode

View the contents of certificates, CSRs and keys:

openssl x509 -in cert.pem -text -noout          # decode a certificate
openssl req -in request.csr -text -noout        # decode a CSR
openssl pkey -in key.pem -text -noout           # inspect a private key
openssl x509 -in cert.pem -noout -dates         # just the validity dates
openssl x509 -in cert.pem -noout -ext subjectAltName   # just the SANs

Generate keys and CSRs

Create a modern key pair and certificate request:

openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out request.csr
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout key.pem -out request.csr
openssl req -in request.csr -noout -verify      # verify the CSR signature

Convert formats

The daily conversions between PEM, DER, P7B and PFX:

openssl x509 -inform der -in cert.cer -out cert.pem      # DER -> PEM
openssl x509 -outform der -in cert.pem -out cert.der     # PEM -> DER
openssl pkcs7 -print_certs -in bundle.p7b -out certs.pem # P7B -> PEM
openssl pkcs12 -export -in cert.pem -inkey key.pem -out bundle.pfx   # PEM -> PFX
openssl pkcs12 -in bundle.pfx -nodes -out everything.pem # PFX -> PEM

Verify and connect

Check chains, match keys, and see what a live server serves:

openssl verify -CAfile chain.pem cert.pem       # validate a chain
openssl x509 -in cert.pem -noout -pubkey | openssl sha256   # match key to cert:
openssl pkey -in key.pem -pubout | openssl sha256           # ...hashes must be equal
openssl s_client -connect host:443 -servername host -showcerts  # live handshake

Try it yourself — free tools

CSR Decoder & Analyzer — openssl req -text, as a web page with compliance checks on top
Certificate Checker — x509 -text and s_client in one tool
Certificate Converter — every conversion above without remembering flags
Key Matcher — the pubkey-hash comparison, done safely in memory

How MI Support IT can help

PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.