Skip to content

OpenSSL β€” Command Reference & Cryptographic Utilities

Last reviewed: 2026-05-29

OpenSSL is a robust, full-featured open-source toolkit implementing the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols, along with a general-purpose cryptographic library. It's the standard tool for certificate management, encryption, decryption, hashing, and random data generation on Linux/Unix systems.

Overview

OpenSSL is a command-line tool and library for:

  • TLS/SSL β€” Secure communication (HTTPS, STARTTLS)
  • X.509 certificates β€” Creation, signing, verification
  • Public/private key management β€” RSA, ECDSA, Ed25519
  • Symmetric encryption β€” AES, ChaCha20
  • Hashing β€” SHA-2, SHA-3, HMAC
  • Random number generation

Training Content

# Generate a cryptographically secure random key encoded as base64
openssl rand -base64 24

This produces a 192-bit (24 bytes) random value suitable for API keys, encryption keys, or tokens.

Essential Commands

Random Data & Key Generation

# Generate random bytes (hex)
openssl rand -hex 32           # 256-bit key

# Generate random bytes (base64)
openssl rand -base64 32         # 256-bit API key

# Generate RSA private key
openssl genrsa -out private.pem 2048

# Generate ECDSA key (P-256)
openssl ecparam -genkey -name prime256v1 -out ecdsa-key.pem

# Generate Ed25519 key
openssl genpkey -algorithm Ed25519 -out ed25519-key.pem

Certificate Generation

# Generate a self-signed certificate + key
openssl req -x509 -nodes -days 365 \
    -newkey rsa:2048 \
    -keyout key.pem \
    -out cert.pem

# Generate Certificate Signing Request (CSR)
openssl req -new -key private.key -out request.csr

# View certificate details
openssl x509 -in cert.pem -text -noout

Encryption / Decryption

# Encrypt a file with AES-256-CBC
openssl enc -aes-256-cbc -salt -in file.txt -out file.enc

# Decrypt
openssl enc -d -aes-256-cbc -in file.enc -out file.txt

# Encrypt with password (-pbkdf2 for modern KDF)
openssl enc -aes-256-cbc -pbkdf2 -salt -in file.txt -out file.enc

Hash Functions

# Compute file hash
openssl dgst -sha256 file.txt
openssl dgst -sha512 file.txt

# HMAC
openssl dgst -sha256 -hmac "secret-key" file.txt

Certificate Information & Validation

# Check a certificate's validity dates
openssl x509 -in cert.pem -dates -noout

# Verify a certificate chain
openssl verify -CAfile ca.pem -untrusted intermediate.pem cert.pem

# Convert PEM to DER
openssl x509 -in cert.pem -outform der -out cert.der

# Convert PEM to PKCS12 (for Windows/Java)
openssl pkcs12 -export -in cert.pem -inkey key.pem -out cert.p12

TLS Connection Testing

# Test TLS connection to a server (like curl but for SSL details)
openssl s_client -connect example.com:443

# Show server certificate
openssl s_client -connect example.com:443 -showcerts </dev/null

# Check SMTP STARTTLS
openssl s_client -starttls smtp -connect mail.example.com:25

Common Use Cases

Use Case Command
API key generation openssl rand -base64 32
Self-signed TLS cert openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
File encryption openssl enc -aes-256-cbc -pbkdf2 -in file -out file.enc
CSR for Let's Encrypt openssl req -new -key key.pem -out csr.pem
Password hash openssl passwd -6 (SHA-512 crypt)
Check cert expiry openssl x509 -in cert.pem -checkend 86400

Security Notes

  • Never use -md5 β€” MD5 is broken for cryptographic use
  • Use modern hashing: SHA-256 or SHA-512, not SHA-1
  • For symmetric encryption, prefer AES-256-GCM (authenticated encryption) over CBC if supported
  • Use PBKDF2 (-pbkdf2) when encrypting with passwords instead of the deprecated -md5 default
  • Ed25519 > ECDSA (P-256) > RSA 2048+ for key types
  • OpenSSL 3.x uses a provider-based architecture β€” check compatibility

Resources