michael orlitzky

OpenSSL Commands I Would Like to Remember

Introduction

OpenSSL is the open-source SSL library you use to do, well, everything on modern Unix systems. It has three million features—roughly one million of which are documented—making it difficult to figure out how to do anything useful.

I will reuse a few variables throughout:

$KEYFILE: The file (either input or output) containing the private key.
$CERTFILE: The file (either input or output) containing the public certificate.
$CSRFILE: The file to which the certificate signing request (CSR) will be written.
$NUM_BITS: The length in bits of the keys we create.
$DAYS: The length in days for which the generated certificate will be valid.

View Certificate Information

Have a certificate on your filesystem somewhere and want to know what it contains?

openssl x509 -in $CERTFILE -noout -text

Renew a Pre-existing Certificate

Already have an e.g. website certificate and want to renew it? This generates a renewal request from the old certificate, and avoids prompting you for all of the certificate information again. Minor downside: I can't figure out how to output to anything other than PEM format.

openssl x509 -x509toreq -in $CERTFILE -out $CSRFILE -signkey $KEYFILE

Create a Self-signed Certificate

(I have written a script, self-signed-cert, which takes care of this whole process.)

There are really two steps involved in creating a self-signed certificate.

Create a private key.

openssl genrsa -out $KEYFILE $NUM_BITS
chmod 400 $KEYFILE

Create a public key (certificate), and sign it.

openssl req -new -x509 -nodes -sha1 -days $DAYS -key $KEYFILE -out $CERTFILE

Request a New Certificate for a Hostname

(I have written a script, vhost-ssl-request, which takes care of this whole process.)

Again, there are two steps involved here.

Create the private key.

openssl genrsa -out $KEYFILE $NUM_BITS
chmod 400 $KEYFILE

Create a certificate signing request (CSR) corresponding to your key.
1
```
openssl req -new -key $KEYFILE -out $CSRFILE
```