Reference Of Most Commonly Used OpenSSL Commands

Checking & Verifying

Certificate

openssl x509 -text -noout -in file.crt

Certificate Signing Request (CSR)

openssl req -verify -text -noout -in file.csr

Private Key

openssl rsa -check -text -noout -in file.key

Certificate Revocation List (CRL)

openssl crl -text -noout -in file.pem

Hashing

OpenSSL can be used to generate a hash from standard input or create a hash for a file.

Standard Input (stdin)

echo -n "text to hash" | openssl ALGORITHM

The -n option makes sure that no trailing newline character is added to the text.

File

openssl ALGORITHM FILE

Hash Algorithms

Possible values for ALGORITHM
md4
md5
mdc2
ripemd160
sha
sha1
ssh224
sha256
sha384
sha512
whirlpool

Please note that some of above hash algorithms are no longer safe for use.

Encrypting & Decrypting

Option	Description
aes-256-cbc	the cipher used for encryption. To get a list of available ciphers: openssl list-cipher-commands
-d	option to tell openssl to decrypt
-a	generate base64 encoded output
-in	the input file
-out	the output file
-pass	KEY	VALUE
	pass	your password
	file	the filename that contains the password

Attention:

• If a password is specified on the command line, it will show up in the process list.
• The option -salt is used by default, thus there's no need to specify it explicitly.

Encrypting

openssl aes-256-cbc [-a] -in INPUT_FILE -out ENCRYPTED_FILE [-pass KEY:VALUE]

Please note that aes-256-cbc is a short form of enc -aes-256-cbc. This means one can either use the cipher name as an option or write it as enc -CIPHER.

Examples:

Encrypt a file (the password is read from standard input):

openssl aes-256-cbc -in unencrypted.txt -out file.enc

Encrypt a file with the password specified in a file named mypassword.txt:

openssl aes-256-cbc -in unencrypted.txt -out file.enc -pass file:mypassword.txt

Decrypting

openssl aes-256-cbc -d [-a] -in ENCRYPTED_FILE -out OUTPUT_FILE [-pass KEY:VALUE] [-md md5]

Attention: One might receive an error with OpenSSL 1.1.0 when trying to decrypt data that was encrypted with OpenSSL 1.0.2. To solve this problem, use the -md md5 flag to decrypt the data.

Examples:

Decrypt a file with the password specified on the command line:

openssl aes-256-cbc -d -in file.enc -out unencrypted.txt -pass pass:mySuperSecretPassword

Decrypt a base64 encoded file:

openssl aes-256-cbc -d -a -in file.enc -out unencrypted.txt

Debugging

Fingerprint

If you want to retrieve the fingerprint of a certificate, use the following command:

openssl x509 -noout -in file.crt -fingerprint -ALGORITHM

Connection Information

To verify the connection, the certificate chain, and the protocol and cipher negotiated, use the following:

openssl s_client -connect HOSTNAME:PORT

The above command will stay in interactive mode until Ctrl+C is pressed. If you want to return to the prompt right away (useful for scripting purposes) do this:

echo "Q" |openssl s_client -connect HOSTNAME:PORT