openssl Command

The openssl command is a command-line tool for using the OpenSSL cryptography library. It is widely used for managing SSL/TLS certificates, encryption, decryption, and other cryptographic operations.

Syntax

openssl <command> [<command_options>] [<command_arguments>]

Description

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It is also a general-purpose cryptography library.

Common uses include:

  • Generating private keys and Certificate Signing Requests (CSRs)
  • Creating self-signed certificates
  • Converting certificate formats
  • Encrypting and decrypting data
  • Verifying certificates

Common Commands and Options

Command/Option Description
genrsa Generate an RSA private key
req Generate and process Certificate Signing Requests (CSRs)
x509 Manage X.509 certificates
pkcs12 Manage PKCS#12 files (e.g., .pfx, .p12)
enc Perform encryption and decryption
dgst Compute message digests (hashes)
s_client Implement a generic SSL/TLS client
-in <file> Input file
-out <file> Output file
-passin <arg> Input file pass phrase source
-passout <arg> Output file pass phrase source

Examples

Generate a 2048-bit RSA private key

openssl genrsa -out private.key 2048

Creates a new 2048-bit RSA private key and saves it to private.key.

Generate a Certificate Signing Request (CSR)

openssl req -new -key private.key -out csr.csr

Generates a new Certificate Signing Request (CSR) from an existing private key. You will be prompted for certificate information.

Create a self-signed certificate

openssl req -x509 -new -key private.key -out certificate.crt -days 365

Creates a self-signed X.509 certificate valid for 365 days from a private key.

View certificate details

openssl x509 -in certificate.crt -text -noout

Displays the human-readable details of a certificate.

Encrypt a file

openssl enc -aes256 -salt -in plaintext.txt -out encrypted.enc

Encrypts plaintext.txt using AES256 encryption with a randomly generated salt. You will be prompted for a password.

Decrypt a file

openssl enc -d -aes256 -in encrypted.enc -out decrypted.txt

Decrypts encrypted.enc using AES256. You will be prompted for the password used during encryption.

See also