OpenSSL 3 cheatsheet

OpenSSL 3: Keys and signing requests

6 common OpenSSL 3 tasks.

Check the OpenSSL version

Print the version and build date.

openssl version -a

Generate an RSA private key

Create a 2048-bit RSA key.

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.key

Caution: Keep private keys secret and restrict their permissions, for example chmod 600.

Generate an elliptic curve key

Create a P-256 key, which is smaller and faster than RSA.

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ec.key

Create a certificate signing request

Generate a key and a CSR to send to a certificate authority, with the domain in the subject alternative name.

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Inspect a CSR

Print a CSR's subject and check its signature.

openssl req -in server.csr -noout -text -verify

Extract the public key

Write the public key from a private key.

openssl pkey -in private.key -pubout -out public.key