openssl

Generate a private key

$ openssl genrsa -out [private.key] [2048]

$ openssl req -new -key [private.key] -out [request.csr]

$ openssl req -x509 -newkey rsa:4096 -keyout [key.pem] -out [cert.pem] -days [365] -nodes

$ openssl x509 -in [certificate.crt] -text -noout

$ openssl x509 -enddate -noout -in [certificate.crt]

$ openssl verify -CAfile [ca.crt] [certificate.crt]

$ openssl s_client -connect [host:443]

$ openssl enc -aes-256-cbc -salt -in [plaintext.txt] -out [encrypted.enc]

$ openssl enc -aes-256-cbc -d -in [encrypted.enc] -out [decrypted.txt]

$ openssl rand -base64 [32]

openssl command [options] [arguments]

OpenSSL is a robust toolkit for cryptographic operations, SSL/TLS protocols, and certificate management. It provides commands for generating keys, creating certificates, encrypting data, testing connections, and performing various cryptographic functions.
The toolkit supports numerous algorithms for encryption (AES, DES, ChaCha20), hashing (SHA, MD5), and public key cryptography (RSA, ECDSA, Ed25519). It can act as a client or server for testing SSL/TLS connections.
OpenSSL is essential for system administrators managing certificates, developers implementing secure communications, and security professionals analyzing cryptographic configurations.

-in file

Input file.

Output file.

No output (for viewing).

Human-readable output.

No DES encryption of private key.

Certificate validity period.

Certificate subject DN.

genrsa

Generate RSA private key.

Certificate signing request operations.

Certificate operations.

RSA key processing.

Symmetric encryption/decryption.

Message digest (hashing).

SSL/TLS client for testing.

SSL/TLS server for testing.

Certificate verification.

Random number generation.

PKCS#12 operations.

Certificate authority operations.

Old versions have known vulnerabilities (update regularly). Encryption commands prompt for passwords interactively. Self-signed certificates cause browser warnings. Some legacy algorithms (MD5, DES) are insecure.

OpenSSL originated from SSLeay, created by Eric Young and Tim Hudson in 1995. It was forked as OpenSSL in 1998 when development of SSLeay ended. The project gained critical importance for internet security, though the Heartbleed vulnerability in 2014 highlighted maintenance challenges. This led to increased funding and the LibreSSL fork by OpenBSD.

ssh-keygen(1), certbot(1), gpg(1), stunnel(1)