openssl commands.txt

Convert PEM CERTs to other common formats
I just used this one yesterday. I got a certificate in PEM format as is my custom. But not every web server out there is apache or apache-compatible. What to do? I’ve learned to convert the PEM-formatted certificates to other favored formats.

The following worked for a Tomcat server and also for another proprietary web server which was running on a Windows server and wanted a pkcs#12 type certificate:

$ openssl pkcs12 -export -chain -inkey drjohns.key -in drjohns.crt -name “drjohnstechtalk.com” -CAfile intermediate_plus_root.crt -out drjohns.p12

The intermediate_plus_root.crt file contained a concatenation of those CERTs, in PEM format of course.

The beauty of the above command is that it also takes care of setting up the intermediate CERT – everything needed is shoved into the .p12 file. .p12 can also be called .pfx.

Examine a certificate

$ openssl x509 -in certificate_name.crt -text

Examine a CSR – certificate signing request

$ openssl req -in certificate_name.csr -text

Examine a private key

$ openssl rsa -in certificate_name.key -text

Create a SAN (subject alternative name) CSR

$ openssl req -new -nodes -out myreq.csr -config req.conf

This creates the private key and CSR in one go. My req.conf looks like:

Verify your certificate chain

$ openssl verify -CAfile …

Look at a certificate and certificate chain of any server running SSL

$ openssl s_client -showcerts -connect https://host[:port]/