OpenSSL Command-Line Essentials

The command "openssl version -a" displays the OpenSSL version, build date, compiler, and configured options. Verifying the version is important because cryptographic capabilities and defaults differ significantly between OpenSSL 1.0.x, 1.1.x, and 3.x. Many older algorithms are disabled by default in newer versions for security.

The command "openssl genrsa -out private.pem 4096" generates a 4096-bit RSA private key in PEM format. For production use, 2048-bit is the minimum, 3072-bit provides ~128-bit security, and 4096-bit provides additional margin. Keys can be AES-encrypted at rest by adding "-aes256" to the command, prompting for a passphrase.

Elliptic curve keys are generated in two steps. First: "openssl ecparam -name prime256v1 -genkey -noout -out ec_private.pem" generates an EC private key using the P-256 curve. Alternative: "openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-384 -out ec_private.pem" using the newer genpkey interface, preferred for new code.

Key contents can be inspected with "openssl rsa -text -noout -in private.pem" for RSA keys, showing the modulus, public exponent, and prime factors. For EC keys: "openssl ec -text -noout -in ec_private.pem" shows the curve name and key value. The "-noout" flag suppresses the PEM-encoded output.

OpenSSL can generate cryptographically secure random bytes: "openssl rand -hex 32" outputs 32 random bytes as hex (64 hex characters), suitable for generating symmetric keys or nonces. "openssl rand -base64 32" outputs base64-encoded random bytes. This uses the OS entropy source (/dev/urandom on Unix systems).

The "openssl dgst" command computes message digests: "openssl dgst -sha256 file.txt" computes the SHA-256 hash of a file. "openssl dgst -sha256 -hmac key file.txt" computes an HMAC-SHA256. "openssl dgst -sha256 -sign private.pem -out sig.bin file.txt" creates a digital signature over the file.

Symmetric file encryption uses "openssl enc -aes-256-cbc -pbkdf2 -in plaintext.txt -out encrypted.bin". The "-pbkdf2" flag uses PBKDF2 for key derivation from the passphrase, replacing the deprecated EVP_BytesToKey. Decryption: "openssl enc -d -aes-256-cbc -pbkdf2 -in encrypted.bin -out decrypted.txt". AEAD modes like AES-256-GCM are preferred for new code.

Certificates and keys exist in two encoding formats. PEM is base64-encoded with header/footer lines (-----BEGIN CERTIFICATE-----), used by most Unix tools. DER is binary encoding, used by Java and Windows. Convert PEM to DER: "openssl x509 -inform PEM -outform DER -in cert.pem -out cert.der". Convert DER to PEM: reverse the -inform/-outform flags.

Digital signature verification: "openssl dgst -sha256 -verify public.pem -signature sig.bin file.txt". The public key must first be extracted: "openssl rsa -pubout -in private.pem -out public.pem". For certificate-based verification: "openssl verify -CAfile ca.pem cert.pem" checks the certificate against the specified CA chain.

Certificate inspection is one of the most common OpenSSL tasks: "openssl x509 -text -noout -in cert.pem" displays all certificate fields including subject, issuer, validity dates, SANs, and extensions. "openssl x509 -enddate -noout -in cert.pem" shows only the expiration date, useful in monitoring scripts.

"openssl s_client -connect example.com:443 -servername example.com" establishes a TLS connection and displays the server's certificate chain, TLS version negotiated, and cipher suite. Adding "-showcerts" displays all certificates in the chain. This is invaluable for debugging certificate chain issues, TLS version problems, and OCSP stapling.

What does the command "openssl genrsa -aes256 -out private.pem 2048" do?

OpenSSL provides commands for key generation (genrsa, genpkey), format conversion (PEM/DER), random data generation (rand), hashing and signing (dgst), file encryption (enc), certificate inspection (x509 -text), chain verification (verify), and TLS debugging (s_client). These cover the vast majority of day-to-day certificate and cryptography tasks.