# OpenSSL cookbook: copy-paste commands with sample output

> Task-based OpenSSL 3.x commands for keys, CSRs, self-signed certs, format conversion, PKCS#12, chain checks, s_client tests, OCSP/CRL and private CAs.

Source: https://ssl.sh/cookbook/
Last updated: 2026-11-10

The cookbook is a set of working OpenSSL commands organized by task. Find the task you need, copy the command, compare your output with the sample, and read the note for the flags that matter. For the background behind a command, follow the links to the [Learn](https://ssl.sh/learn/how-tls-works/) articles.

## How to use these pages

Each page has 8 to 15 tasks with the same layout: a `##` heading that names the task, a one-line answer, the command in a `bash` block, sample output in a `text` block and a note on options and pitfalls. File names are consistent across pages: `example.com.key` for a private key, `example.com.crt` for the certificate, `chain.pem` for intermediates and `fullchain.pem` for certificate plus chain.

Check which OpenSSL you are running before you start:

```bash
openssl version
```

```text
OpenSSL 3.6.1 27 Jan 2026 (Library: OpenSSL 3.6.1 27 Jan 2026)
```

## Version differences that change results

| Change | Since | What it affects |
|---|---|---|
| PKCS#12 export defaults to AES-256-CBC, PBKDF2 and an HMAC-SHA256 MAC; RC2/3DES/SHA-1 need `-legacy` | 3.0 | [PKCS#12](https://ssl.sh/cookbook/pkcs12/), [format conversion](https://ssl.sh/cookbook/convert-formats/) |
| `-noenc` replaces the deprecated `-nodes` | 3.0 | [Keys](https://ssl.sh/cookbook/generate-keys/), [CSRs](https://ssl.sh/cookbook/csr/), [self-signed](https://ssl.sh/cookbook/self-signed/) |
| TLS 1.0/1.1 blocked at the default security level; testing them needs `@SECLEVEL=0` | 3.0 | [Ciphers and protocols](https://ssl.sh/cookbook/ciphers-and-protocols/) |
| `-copy_extensions` for `x509` and `req` | 3.0 | [Private CA](https://ssl.sh/cookbook/private-ca/) |
| ML-KEM, ML-DSA and SLH-DSA built in; default TLS key shares include X25519MLKEM768 | 3.5 | [Keys](https://ssl.sh/cookbook/generate-keys/), [test connections](https://ssl.sh/cookbook/test-connections/) |

## Safety

Run key-generation commands on a machine you control and keep private keys out of version control. Never paste a production private key into a website. Tools on ssl.sh that handle keys run in the browser, but the safest key is one that never leaves the server it belongs to.