c_rehash.1s

c_rehash [-h] [-l] [-n] [-u] [-v] [-f] [directory ...]

-h
    Print a short help message and exit.


-l
    List entries without creating or updating links.


-n
    Do not create or update any links (dry run).


-u
    Remove links to old hashes before converting to new format.


-v
    Enable verbose mode for detailed output.


-f
    Force overwriting of existing links.


directory
    Target directory(ies) to rehash; defaults from openssl.cnf if omitted.

The c_rehash command is a Perl script provided by OpenSSL to automate the creation of symbolic links for certificates, certificate revocation lists (CRLs), and related files in directories used by SSL/TLS-enabled servers like Apache or Nginx. These servers often expect certificate files to be named using a hash of the subject's name (traditionally MD5, now SHA-256) for lookup in HashDir configurations.

Running c_rehash directory scans the specified directory (or defaults from openssl.cnf), computes the hash for each .pem, .crt, .crl, or .der file, and creates or updates symlinks named <hash>.0 (certificates) or <hash>.r0 (CRLs). This ensures compatibility with legacy setups relying on hashed filenames.

It supports verbose output, listing without changes, and forcing overwrites. Primarily used post-certificate installation or renewal to refresh the hash index without manual c_hash invocation.

Note: Widely used in sysadmin tasks for web servers, but deprecated in modern OpenSSL versions.

Deprecated in OpenSSL 1.1.1+; use openssl rehash instead. May overwrite files with -f. Assumes standard HashDir layout; incompatible with custom setups. Symlinks only—no copying.

Reads openssl.cnf (or $OPENSSL_CONF) for ssl_client|server sections defining directories like <TopDir>/certs.

Creates links as <SHA256_hash>.0 for certs, <hash>.r0 for CRLs (new format); supports legacy MD5 with -u.

Introduced in early OpenSSL (pre-1.0) as a convenience script alongside c_hash. Updated in OpenSSL 1.0.0+ for SHA-256 support. Deprecated since 1.1.1 (2018) with warning messages directing to openssl rehash; retained for backward compatibility but may be removed in future releases.

openssl(1), c_hash(1), req(1)