OpenSSL 3: Certificates

Create a self-signed certificate

Create a key and certificate valid for a year, for testing only.

openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

Caution: Browsers don't trust self-signed certificates. Use them only for local development.

Read a certificate

Print a certificate's subject, issuer, validity dates and extensions.

openssl x509 -in cert.pem -noout -text

Show a certificate's dates

Print only the start and expiry dates.

openssl x509 -in cert.pem -noout -dates

Get a certificate's fingerprint

Print the SHA-256 fingerprint, used to confirm which certificate you have.

openssl x509 -in cert.pem -noout -fingerprint -sha256

Check if a certificate expires soon

Exit with an error if the certificate expires within 30 days (2,592,000 seconds). Handy in monitoring scripts.

openssl x509 -in cert.pem -noout -checkend 2592000

Verify a certificate against a CA

Check that a certificate was signed by a CA and is valid.

openssl verify -CAfile ca.pem cert.pem

Check that a key matches a certificate

Compare the public key hashes of a certificate and a private key. They must be identical.

openssl x509 -in cert.pem -noout -pubkey | openssl sha256
openssl pkey -in private.key -pubout | openssl sha256