OpenSSL — basics and most important commands

OpenSSL — basics and most important commands

2026-01-12

OpenSSL is a versatile tool for working with certificates, keys, and SSL/TLS protocols — useful for both server administrators and developers. In this post, I will explain the most important concepts and present accessible examples of the most commonly used commands.

What you will learn

  • How to generate a private key and a CSR (Certificate Signing Request)
  • How to create a self-signed certificate for testing
  • How to check and convert certificate formats (PEM/DER/PFX)
  • A few practical tips and warnings

Installation

On most Linux distributions, OpenSSL is available from the package manager:

# Debian/Ubuntu
sudo apt update && sudo apt install openssl

# Fedora/CentOS/RHEL
sudo dnf install openssl

Generating a private key

RSA 2048-bit:

openssl genpkey -algorithm RSA -out key.pem -pkeyopt rsa_keygen_bits:2048

Alternatively (more common):

openssl genrsa -out key.pem 2048

Set file access permissions for the key:

chmod 600 key.pem

Creating a CSR (Certificate Signing Request)

openssl req -new -key key.pem -out request.csr -subj "/C=PL/ST=Mazowieckie/L=Warszawa/O=Example/OU=IT/CN=example.com"

You can also use openssl req -new -key key.pem -out request.csr and fill in the details interactively.

Self-signed certificate (for testing)

Useful for testing or internal environments:

openssl req -x509 -days 365 -key key.pem -in request.csr -out cert.pem

Checking certificate and CSR

Displaying information about a PEM certificate:

openssl x509 -in cert.pem -text -noout

Viewing the contents of a CSR:

openssl req -in request.csr -noout -text

Format conversions

PEM -> DER (binary):

openssl x509 -in cert.pem -outform der -out cert.der

PEM + key -> PFX (PKCS#12):

openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem -passout pass:YourPassword

Verifying key and certificate match

Compare public key hashes:

openssl rsa -in key.pem -pubout -outform pem | sha256sum
openssl x509 -in cert.pem -pubkey -noout -outform pem | sha256sum

Practical tips 🔧

  • Never store private keys with open permissions for other users.
  • For a production server, use certificates issued by a trusted CA.
  • -nodes when generating PKCS#12 files disables key encryption — use with caution.

Resources and documentation

If you want, I can add example scripts, automation procedures, or a chapter on generating ECC instead of RSA. Let me know what you need!