OpenSSL 3 cheatsheet

OpenSSL 3: Converting, hashing and encrypting

9 common OpenSSL 3 tasks.

Convert PEM to DER

Convert a certificate between text (PEM) and binary (DER) encodings.

openssl x509 -in cert.pem -outform DER -out cert.der

Create a .p12 or .pfx file, for example for Windows or Java. You are prompted for a password.

openssl pkcs12 -export -inkey private.key -in cert.pem -out bundle.p12

Extract the certificate and key from a bundle as PEM.

openssl pkcs12 -in bundle.p12 -nodes -out all.pem

Print the SHA-256 digest of a file.

openssl dgst -sha256 file.txt

Print 32 random bytes as 64 hex characters, suitable for a secret key.

openssl rand -hex 32

Encode text as Base64. Add -d to decode.

echo -n 'hello' | openssl base64

Encrypt with AES-256 and a key derived from the password. You are prompted for it.

openssl enc -aes-256-cbc -pbkdf2 -salt -in secret.txt -out secret.enc

Reverse the encryption above with the same password.

openssl enc -d -aes-256-cbc -pbkdf2 -in secret.enc -out secret.txt

Create a signature with a private key, then check it with the public key.

openssl dgst -sha256 -sign private.key -out file.sig file.txt
openssl dgst -sha256 -verify public.key -signature file.sig file.txt