# OpenSSL Command Generator: CSR, Convert, Check, s_client

> Build correct OpenSSL commands: keys and CSRs with SANs, self-signed certs, PEM/DER/PFX/P7B conversion, key matching, s_client tests.

Source: https://ssl.sh/tools/openssl-command-generator/
Last updated: 2026-11-10

Pick a task, fill in the names and get a ready-to-run OpenSSL command, with notes on OpenSSL 3 differences.

The OpenSSL command generator turns a short form into a correct `openssl` command line. Choose a task, such as "New key + CSR with SANs" or "PFX → PEM", fill in the domain and file names, and copy the command. The command updates as you type.

## How to use it

1. Choose a task from the list. Tasks are grouped into keys and CSRs, inspection, format conversion and server tests.
2. Fill in the fields that appear: domain, extra SANs, file names, host and port.
3. Copy the command and run it in a terminal.

Example: a new ECDSA key and CSR for two names:

```bash
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
  -keyout example.com.key -out example.com.csr -subj /CN=example.com \
  -addext subjectAltName=DNS:example.com,DNS:www.example.com
```

## Tasks covered

- **Keys and certificates**: RSA and ECDSA keys, CSR with SANs, CSR from an existing key, self-signed certificate.
- **Inspect**: certificate and CSR details, expiry date (local file or live server), fingerprint and SPKI pin, chain verification, whether a certificate, key and CSR belong together.
- **Convert**: PEM ↔ DER, PEM + key → PFX (with a compatibility mode), PFX → PEM, P7B → PEM.
- **Test servers**: `s_client` with SNI, STARTTLS for SMTP/IMAP/POP3/FTP/XMPP/PostgreSQL, TLS 1.0–1.3 support, TLSA hash.

## Version notes

- `-addext` arrived in OpenSSL 1.1.1. On older systems put the SANs in a config file.
- `-nodes` (no DES) leaves the private key unencrypted, which web servers need; OpenSSL 3 also accepts `-noenc`.
- OpenSSL 3 creates PFX files with AES-256 and an HMAC-SHA256 MAC. Windows Server 2016 and Java 8 need the 3DES/SHA-1 compatibility options.
- If you prefer not to use a terminal, the in-browser [CSR generator](https://ssl.sh/tools/csr-generator/), [SSL converter](https://ssl.sh/tools/ssl-converter/) and [key matcher](https://ssl.sh/tools/key-matcher/) do the same jobs.


## FAQ

**Why does openssl pkcs12 say 'unsupported' or mention RC2?**

OpenSSL 3 moved old algorithms such as RC2 into the legacy provider. Add -legacy when reading an old PFX. When creating a PFX for old Windows or Java, use -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1.

**How do I check which OpenSSL version I have?**

Run openssl version. On macOS the system binary reports LibreSSL; Homebrew installs OpenSSL 3 as a separate binary.

**Why does s_client hang?**

s_client waits for input after the handshake. Redirect stdin from /dev/null (as the generated commands do) or pipe echo into it so it exits after printing the certificate.