Certificates - mwicat/personal GitHub Wiki
cat /etc/ca-certificates.conf
sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt
sudo update-ca-certificates
openssl req -new -newkey rsa:4096 -nodes -out yourdomain_com.csr -keyout yourdomain_com.key -subj "/CN=yourdomain.com"openssl req -in mycsr.csr -noout -text
openssl req -newkey rsa:4096 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem
cat server.key server.crt > server.pem
openssl genrsa -out server.key 1024
openssl req -new -key server.key -x509 -days 3653 -out server.crtsudo socat openssl-listen:443,fork,reuseaddr,cert=server.pem -openssl s_client -showcerts -servername google.com -connect google.com:443 -CApath /etc/ssl/certs
test specific host:
curl --resolve yourhost.com:443:<host ip> https://yourhost.com/openssl x509 -text -noout -in mycert.crt
nmap -p 443 --script ssl-cert gnupg.org
nmap -p 443 --script ssl-enum-ciphers domain
nmap -p 443 --script ssl-enum-ciphers --script-args tls.servername=mydomain.net domain_or_ip
openssl s_client -servername www.mnot.net -tlsextdebug -connect www.mnot.net:443 2>/dev/null | grep "server extension"import ssl
from OpenSSL import crypto
cert = ssl.get_server_certificate(('google.com', 443))
x509 = crypto.load_certificate(crypto.FILETYPE_PEM, cert)
pubKey = x509.get_pubkey()
pubKeyString = crypto.dump_publickey(crypto.FILETYPE_PEM, pubKey)
subject = x509.get_subject()
cn = subject.CNmultiple domains - pro = only one certificate needed, against = all domains must pass validation when needed
docker run -v $(pwd):/results -it --rm drwetter/testssl.sh --htmlfile /results/www_google_com.html www.google.com