Here’s a Linux openssl Cheat Sheet with common commands and practical examples:

openssl is a versatile command-line tool for SSL/TLS certificates, keys, and cryptographic operations.

• Linux openssl Cheat Sheet
  • 1. Key and Certificate Management
    • Generate a Private Key
    • Generate a Self-Signed Certificate
    • Generate a Certificate Signing Request (CSR)
    • Check Certificate Details
    • Check CSR Details
    • Check Private Key Details
    • Convert Private Key Formats
      • PEM to DER
      • DER to PEM
    • Convert Certificate Formats
      • PEM to DER
      • DER to PEM
    • Convert PKCS#12 (.p12) to PEM
    • Convert PEM to PKCS#12 (.p12)
  • 2. Encryption and Decryption
    • Encrypt a File
    • Decrypt a File
  • 3. Hashing
    • Generate a Hash
    • Verify a Hash
  • 4. SSL/TLS Testing
    • Test a Remote SSL Server
    • Check Certificate Expiry
  • 5. Common Options
  • 6. Tips

openssl genpkey -algorithm RSA -out private.key -pkeyopt rsa_keygen_bits:2048

• Creates a 2048-bit RSA private key (private.key).

openssl req -x509 -newkey rsa:2048 -keyout private.key -out cert.crt -days 365 -nodes

• Creates a self-signed certificate (cert.crt) and private key (private.key) valid for 365 days.
• -nodes: Skips password protection.

openssl req -new -key private.key -out request.csr

• Generates a CSR (request.csr) using an existing private key.

openssl x509 -in cert.crt -text -noout

• Displays detailed information about a certificate (cert.crt).

openssl req -in request.csr -text -noout

• Displays details of a CSR (request.csr).

openssl rsa -in private.key -text -noout

• Displays details of a private key (private.key).

openssl rsa -in private.key -outform DER -out private.der

openssl rsa -inform DER -in private.der -out private.pem

openssl x509 -in cert.crt -outform DER -out cert.der

openssl x509 -inform DER -in cert.der -out cert.pem

openssl pkcs12 -in cert.p12 -out cert.pem -nodes

• Extracts certificates and private keys from a .p12 file.

openssl pkcs12 -export -out cert.p12 -inkey private.key -in cert.crt

• Combines a private key and certificate into a .p12 file.

openssl enc -aes-256-cbc -salt -in file.txt -out file.enc

• Encrypts file.txt using AES-256-CBC and outputs file.enc.

openssl enc -d -aes-256-cbc -in file.enc -out file.txt

• Decrypts file.enc back to file.txt.

openssl dgst -sha256 file.txt

• Computes the SHA-256 hash of file.txt.

openssl dgst -sha256 -verify public.key -signature file.sig file.txt

• Verifies a signature (file.sig) using a public key.

openssl s_client -connect example.com:443 -servername example.com

• Connects to example.com on port 443 and displays the SSL certificate.

openssl x509 -enddate -noout -in cert.crt

• Shows the expiry date of cert.crt.

• Backup Keys: Always back up private keys securely.
• Permissions: Restrict access to private keys (chmod 400 private.key).
• Passwords: Use strong passwords for private keys and keystores.