openssl(1)
OpenSSL is a toolkit for working with SSL/TLS certificates, cryptographic operations, and secure communications.
Synopsis
openssl command [options] [arguments]Description
OpenSSL is a robust, full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It provides command-line tools for certificate generation, encryption, decryption, hashing, and digital signing operations.
The command operates as a suite of subcommands—each subcommand handles a specific cryptographic task such as creating certificate signing requests, viewing certificate contents, or performing encryption. Common categories include certificate management (req, x509), key management (genrsa, genpkey), and data operations (enc, dgst).
OpenSSL is essential for system administrators, developers, and security professionals managing SSL/TLS infrastructure, testing encrypted connections, and performing cryptographic operations from the command line.
Common options
| Flag | What it does |
|---|---|
-in FILE | input file for the operation (certificates, keys, data to process) |
-out FILE | output file for the result (default: standard output) |
-text | print certificate or key in human-readable text format |
-noout | suppress the output of the encoded version of the object |
-inform FORMAT | input format: PEM (default), DER, or PKCS12 |
-outform FORMAT | output format: PEM (default), DER, or PKCS12 |
-days NUM | validity period in days for generated certificates |
-nodes | do not encrypt the private key (no DES encryption) |
-subj STRING | subject distinguished name for certificate requests (e.g., '/CN=example.com') |
-pubkey | extract and output the public key from a certificate or key |
Examples
generate a 2048-bit RSA private key and certificate signing request (CSR) for example.com in one step
openssl req -new -newkey rsa:2048 -nodes -out request.csr -keyout private.key -subj '/CN=example.com'display the human-readable contents of a certificate without showing the encoded data
openssl x509 -in certificate.pem -text -nooutgenerate a 2048-bit RSA private key and save it to a file
openssl genrsa -out private.key 2048connect to a remote HTTPS server and display its SSL/TLS certificate chain
openssl s_client -connect example.com:443 -showcertsencrypt a file using AES-256 with a salt-derived key from a password
openssl enc -aes-256-cbc -salt -in plaintext.txt -out encrypted.bin -k mypasswordcreate a digital signature of a file using SHA-256 and a private key
openssl dgst -sha256 -sign private.key document.txt > signature.binsign a certificate signing request with your CA certificate to issue a new certificate valid for 365 days
openssl x509 -req -in request.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out signed.crt -days 365verify that a certificate is validly signed by a trusted CA
openssl verify -CAfile ca-bundle.pem certificate.pem