Inspecting certificates & CSRs
| Command | What it does |
| openssl x509 -in cert.pem -text -noout | View every field in a PEM certificate — subject, issuer, validity, SAN, everything. |
| openssl x509 -in cert.pem -noout -dates | Show just the validity window (Not Before / Not After). |
| openssl x509 -in cert.pem -noout -subject -issuer | Show just the Subject and Issuer, one line each. |
| openssl x509 -in cert.pem -noout -fingerprint -sha256 | Get the certificate's SHA-256 fingerprint. |
| openssl req -in request.csr -text -noout -verify | Decode a CSR and confirm its signature is internally valid. |
| openssl s_client -connect host:443 -showcerts | Connect to a live server and show the full chain it presents. |
Generating keys, CSRs & self-signed certs
| Command | What it does |
| openssl genrsa -out key.pem 2048 | Generate a 2048-bit RSA private key (PKCS#1 format). |
| openssl ecparam -genkey -name prime256v1 -out key.pem | Generate an ECDSA private key on the P-256 curve. |
| openssl req -new -key key.pem -out request.csr | Generate a CSR from an existing private key, prompting for subject fields. |
| openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out request.csr | Generate a new key and CSR together, in one command. |
| openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 | Generate a self-signed certificate and key together — for local dev only. |
Converting between formats
| Command | What it does |
| openssl x509 -in cert.pem -outform der -out cert.der | PEM certificate → DER. |
| openssl x509 -inform der -in cert.der -out cert.pem | DER certificate → PEM. |
| openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem -certfile chain.pem | Combine a PEM cert, key, and chain into a PFX/P12 bundle. |
| openssl pkcs12 -in cert.pfx -out cert.pem -nodes | Extract a certificate + key from a PFX/P12 file into PEM. |
| openssl rsa -in key.pem -out key_pkcs8.pem | PKCS#1 ("RSA PRIVATE KEY") → still PKCS#1, re-saved. |
| openssl pkcs8 -topk8 -nocrypt -in key.pem -out key_pkcs8.pem | PKCS#1 → PKCS#8 ("PRIVATE KEY"). |
Verifying keys & chains match
| Command | What it does |
| openssl x509 -noout -modulus -in cert.pem | openssl md5 | Get a certificate's modulus hash — compare against the key's. |
| openssl rsa -noout -modulus -in key.pem | openssl md5 | Get a private key's modulus hash — compare against the cert's. |
| openssl verify -CAfile chain.pem cert.pem | Verify a certificate against a specific CA chain file. |
| openssl s_client -connect host:443 -cert cert.pem -key key.pem | Test a connection presenting a specific client certificate (mTLS). |
Testing a live server
| Command | What it does |
| openssl s_client -connect host:443 -servername host | Connect with SNI explicitly set — needed when testing a multi-cert server by IP. |
| openssl s_client -connect host:443 -tls1_2 | Force a specific TLS version to confirm whether a server accepts it. |
| openssl s_client -connect host:443 -status | Request and display the stapled OCSP response, if any. |
| openssl s_client -connect host:587 -starttls smtp | Test STARTTLS on a mail server (swap smtp for imap or pop3 as needed). |
| echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -enddate | One-liner: check a live server's certificate expiry date. |
Common TLS-secured ports
Worth knowing when a connection test on the wrong port produces a confusing failure that has nothing to do with the certificate itself.
| Port | What runs there |
| 443 | HTTPS — standard web traffic |
| 465 | SMTPS — implicit TLS for outgoing mail |
| 587 | SMTP with STARTTLS — the modern standard for outgoing mail submission |
| 993 | IMAPS — implicit TLS for reading mail |
| 995 | POP3S — implicit TLS for reading mail (older protocol) |
| 636 | LDAPS — implicit TLS for directory services |
| 989 / 990 | FTPS — implicit TLS for file transfer (data / control channels) |
| 8443 | A common alternate HTTPS port for admin panels and internal tools |