OpenSSL cookbook
Twelve pages of task-based OpenSSL 3.x recipes. Each task gives the command, real sample output and a short note on flags, version differences and pitfalls.
The cookbook is a set of working OpenSSL commands organized by task. Find the task you need, copy the command, compare your output with the sample, and read the note for the flags that matter. For the background behind a command, follow the links to the Learn articles.
How to use these pages
Each page has 8 to 15 tasks with the same layout: a ## heading that names the task, a one-line answer, the command in a bash block, sample output in a text block and a note on options and pitfalls. File names are consistent across pages: example.com.key for a private key, example.com.crt for the certificate, chain.pem for intermediates and fullchain.pem for certificate plus chain.
Check which OpenSSL you are running before you start:
openssl version
OpenSSL 3.6.1 27 Jan 2026 (Library: OpenSSL 3.6.1 27 Jan 2026)
Version differences that change results
| Change | Since | What it affects |
|---|---|---|
PKCS#12 export defaults to AES-256-CBC, PBKDF2 and an HMAC-SHA256 MAC; RC2/3DES/SHA-1 need -legacy |
3.0 | PKCS#12, format conversion |
-noenc replaces the deprecated -nodes |
3.0 | Keys, CSRs, self-signed |
TLS 1.0/1.1 blocked at the default security level; testing them needs @SECLEVEL=0 |
3.0 | Ciphers and protocols |
-copy_extensions for x509 and req |
3.0 | Private CA |
| ML-KEM, ML-DSA and SLH-DSA built in; default TLS key shares include X25519MLKEM768 | 3.5 | Keys, test connections |
Safety
Run key-generation commands on a machine you control and keep private keys out of version control. Never paste a production private key into a website. Tools on ssl.sh that handle keys run in the browser, but the safest key is one that never leaves the server it belongs to.
Keys, CSRs and certificates
Generate keys
Copy-paste OpenSSL 3.x commands to generate, encrypt, decrypt, inspect and match RSA, ECDSA, Ed25519, ML-DSA and ML-KEM private keys.
Create a CSR
OpenSSL 3.x commands to create, inspect and verify certificate signing requests with subjectAltName, wildcard names, config files and UTF-8 subjects.
Self-signed certificates
One-line OpenSSL 3.x commands for self-signed certificates with SANs, localhost dev certs, and adding them to macOS, Windows and Linux trust stores.
Inspect certificates
OpenSSL 3.x commands to read a certificate: full text, subject, dates, fingerprint, SANs, expiry checks, remote and DER files, chains, revocation URLs, SCTs.
Formats and PKCS#12
Convert formats
OpenSSL 3.x and keytool commands to identify a certificate file's format and convert it between PEM, DER, PKCS#7 (.p7b), PKCS#12 (.pfx) and JKS.
PKCS#12 / PFX
Create, inspect, split and repair PKCS#12/PFX files with OpenSSL 3.x: the AES-256 default since 3.0, -legacy for old Windows and Java, common errors.
Verification and testing
Verify certificate chains
OpenSSL 3.x commands to verify a certificate chain: -CAfile vs -untrusted, hostname and EKU checks, missing intermediates, chain order, key match.
Test TLS connections
Practical openssl s_client commands: SNI and -servername, -showcerts, TLS 1.2/1.3, ALPN, STARTTLS for mail and databases, stapling, mTLS.
OCSP and CRL
Check certificate revocation with OpenSSL 3.x: find OCSP and CRL URLs, query responders, read stapled responses, verify with -crl_check.
Ciphers and protocols
OpenSSL 3.x commands to expand cipher strings, test TLS 1.0-1.3, enumerate a server's cipher suites and check X25519MLKEM768 support.
Private CA and troubleshooting
FAQ
Which OpenSSL version do these commands need?
OpenSSL 3.0 or newer. Commands that need a later release are marked, for example ML-KEM and ML-DSA keys, which need 3.5 or newer. Sample output was captured with OpenSSL 3.6.1.
Why does a command fail on my Mac?
macOS ships LibreSSL as /usr/bin/openssl, which lacks several OpenSSL 3.x options. Install OpenSSL 3 (for example with Homebrew) and call it by its full path, or put it first on your PATH.
Is there a tool that builds these commands for me?
Yes. The OpenSSL command generator builds the common commands from a form, and the SSL converter converts formats in your browser.