Tool cheatsheet

OpenSSL 3 Cheatsheet

Generate keys and certificates, inspect and verify TLS certificates, convert formats, hash and encrypt with OpenSSL 3.

Keys and signing requests

Check the OpenSSL version — Print the version and build date.
Generate an RSA private key — Create a 2048-bit RSA key.
Generate an elliptic curve key — Create a P-256 key, which is smaller and faster than RSA.
Create a certificate signing request — Generate a key and a CSR to send to a certificate authority, with the domain in the subject alternative name.
Inspect a CSR — Print a CSR's subject and check its signature.
Extract the public key — Write the public key from a private key.

Create a self-signed certificate — Create a key and certificate valid for a year, for testing only.
Read a certificate — Print a certificate's subject, issuer, validity dates and extensions.
Show a certificate's dates — Print only the start and expiry dates.
Get a certificate's fingerprint — Print the SHA-256 fingerprint, used to confirm which certificate you have.
Check if a certificate expires soon — Exit with an error if the certificate expires within 30 days (2,592,000 seconds). Handy in monitoring scripts.
Verify a certificate against a CA — Check that a certificate was signed by a CA and is valid.
Check that a key matches a certificate — Compare the public key hashes of a certificate and a private key. They must be identical.

Inspect a server's certificate — Connect to a server and print its certificate chain. -servername sets SNI, which many hosts need.
Check a site's certificate expiry — Print the dates of the certificate a server presents.
Test a TLS version — Check whether a server accepts TLS 1.3.
Test STARTTLS on a mail server — Connect over SMTP and upgrade to TLS.
Run a quick TLS test server — Serve a certificate on a port to test clients.

Convert PEM to DER — Convert a certificate between text (PEM) and binary (DER) encodings.
Bundle a key and certificate as PKCS#12 — Create a .p12 or .pfx file, for example for Windows or Java. You are prompted for a password.
Extract from a PKCS#12 bundle — Extract the certificate and key from a bundle as PEM.
Hash a file — Print the SHA-256 digest of a file.
Generate random bytes — Print 32 random bytes as 64 hex characters, suitable for a secret key.
Encode and decode Base64 — Encode text as Base64. Add -d to decode.
Encrypt a file with a password — Encrypt with AES-256 and a key derived from the password. You are prompted for it.
Decrypt a file — Reverse the encryption above with the same password.
Sign and verify a file — Create a signature with a private key, then check it with the public key.

Ansible 2 cheatsheet — Run ad-hoc commands and playbooks, manage inventories, roles, collections and secrets with Ansible.
Argo CD 3 cheatsheet — Install Argo CD, define Applications declaratively, and manage sync, diffs, history and rollbacks with the argocd CLI.
AWS CLI 2 cheatsheet — Configure credentials and manage S3, EC2, Lambda, logs, containers and secrets with the AWS CLI v2.
Azure CLI 2 cheatsheet — Sign in and manage resource groups, VMs, web apps, storage, Kubernetes, registries and secrets with the az command.
Bash and Linux 5 cheatsheet — Everyday shell and Linux commands for files, searching text, permissions, processes and servers.
Claude API cheatsheet — Call Claude from Python, TypeScript or curl: messages, streaming, thinking, tools, structured output, caching, batches and error handling.