OpenSSL command generator

The OpenSSL command generator turns a short form into a correct openssl command line. Choose a task, such as "New key + CSR with SANs" or "PFX → PEM", fill in the domain and file names, and copy the command. The command updates as you type.

How to use it

1. Choose a task from the list. Tasks are grouped into keys and CSRs, inspection, format conversion and server tests.
2. Fill in the fields that appear: domain, extra SANs, file names, host and port.
3. Copy the command and run it in a terminal.

Example: a new ECDSA key and CSR for two names:

openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
  -keyout example.com.key -out example.com.csr -subj /CN=example.com \
  -addext subjectAltName=DNS:example.com,DNS:www.example.com

Tasks covered

• Keys and certificates: RSA and ECDSA keys, CSR with SANs, CSR from an existing key, self-signed certificate.
• Inspect: certificate and CSR details, expiry date (local file or live server), fingerprint and SPKI pin, chain verification, whether a certificate, key and CSR belong together.
• Convert: PEM ↔ DER, PEM + key → PFX (with a compatibility mode), PFX → PEM, P7B → PEM.
• Test servers: s_client with SNI, STARTTLS for SMTP/IMAP/POP3/FTP/XMPP/PostgreSQL, TLS 1.0–1.3 support, TLSA hash.

Version notes

• -addext arrived in OpenSSL 1.1.1. On older systems put the SANs in a config file.
• -nodes (no DES) leaves the private key unencrypted, which web servers need; OpenSSL 3 also accepts -noenc.
• OpenSSL 3 creates PFX files with AES-256 and an HMAC-SHA256 MAC. Windows Server 2016 and Java 8 need the 3DES/SHA-1 compatibility options.
• If you prefer not to use a terminal, the in-browser CSR generator, SSL converter and key matcher do the same jobs.