OpenSSL CLI Cheat Sheet & Certificate Management

SSL Certificate

A practical reference of essential OpenSSL commands for inspecting TLS endpoints, generating Certificate Signing Requests (CSRs), validating key/cert modulus matching, and converting certificate formats.

1. Inspect Live TLS Certificates

# Connect and view remote server certificate chain
openssl s_client -showcerts -servername example.com -connect example.com:443

# Check certificate expiration date from a remote host
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates

2. Validate Key, Certificate & CSR Modulus Matching

To verify that a private key, SSL certificate, and CSR belong to the exact same cryptographic keypair, compare their MD5 hashes of the modulus:

openssl x509 -noout -modulus -in vettom.crt | openssl md5
openssl rsa  -noout -modulus -in vettom.key | openssl md5
openssl req  -noout -modulus -in vettom.csr | openssl md5

If all three hashes match identically, the key, certificate, and CSR are fully compatible.

3. Generate CSR with Subject Alternative Names (SAN)

san.cnf

[req]
default_bits       = 2048
prompt             = no
default_md         = sha256
req_extensions     = req_ext
distinguished_name = dn

[dn]
C  = GB
ST = London
L  = London
O  = Vettom Engineering
CN = vettom.online

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = vettom.online
DNS.2 = *.vettom.online
DNS.3 = api.vettom.online

# Generate private key and SAN CSR
openssl req -new -newkey rsa:2048 -nodes \
  -keyout vettom.key \
  -out vettom.csr \
  -config san.cnf

4. PKCS#12 (PFX) Certificate Conversions

# Export PEM Cert & Private Key to PFX archive (for Azure/Windows)
openssl pkcs12 -export -out bundle.pfx \
  -inkey vettom.key \
  -in vettom.crt \
  -certfile ca-chain.crt

# Extract private key from PFX (unencrypted)
openssl pkcs12 -in bundle.pfx -nocerts -nodes -out extracted-key.pem

# Extract public certificates from PFX
openssl pkcs12 -in bundle.pfx -nokeys -out extracted-cert.pem