OpenSSL command description

Source: Internet
Author: User
Tags certificate fingerprint modulus openssl rsa openssl x509

Using OpenSSL utilities

An OpenSSL command line takes the following form:

openssl utility arguments 

For example:

openssl x509 -in OrbixCA -text 

Each Command is individually described in this Appendix. To get a list of the arguments associated with a particle command, use the-help option as follows:

openssl utility -help 

For example:

openssl x509 -help 
The X509 Utility

In orbix 2000 SSL/TLS the X509 utility is mainly used:

  • Printing text details of certificates you wish to examine.

  • Converting certificates to different formats.

The options supported by the OpenSSL X509 utility are as follows:

-Inform ARG

-Input format-default PEM
(One of DER, net or PEM)

-Outform ARG

-Output format-default PEM
(One of DER, net or PEM

-Keyform ARG

-Private Key format-default PEM

-Caform ARG

-Ca format-default PEM

-Cakeyform ARG

-Ca key format-default PEM


-Input file-default stdin

-Out ARG

-Output file-default stdout


-Print serial number value


-Print serial number value


-Print subject DN


-Print issuer DN


-Notbefore Field


-Notafter Field


-Both before and after dates


-Print the RSA key Modulus


-Print the certificate fingerprint


-No certificate output

-Days ARG

-How long till expiry of a signed certificate
-Def 30 days

-Signkey ARG

-Self sign cert with ARG


-Output a certification request object


-Input is a certificate request, sign and Output


-Set the CA certificate, must be PEM format

-Cakey ARG

-Set the CA key, must be PEM format. If missing it is assumed to be in the CA File


-Create serial number file if it does not exist


-Serial File


-Print the Certificate in text form


-Print out C code forms


-Digest to do an RSA sign


Using the X509 Utility

To print the text details of an existing PEM-format X.509 Certificate, use the X509 utility as follows:

openssl x509 -in MyCert.pem -inform PEM -text 

To print the text details of an existing der-format X.509 Certificate, use the X509 utility as follows:

openssl x509 -in MyCert.der -inform DER -text 

To change a certificate from PEM format to der format, use the X509 utility as follows:

openssl x509 -in MyCert.pem -inform PEM -outform DER -out MyCert.der 
The req Utility

The req utility is used to generate a self-signed certificate or a Certificate Signing Request (CSR ). a csr contains details of a certificate to be issued by a ca. when creating a CSR, the req command prompts you for the necessary information from which a certificate request file and an encrypted private key file are produced. the certificate request is then submitted to a CA for signing.

If the-nodes (No DEs) parameter is not supplied to req, you are prompted for a pass phrase which will be used to protect the private key.

It is important to specify a validity period (using the-days parameter). If the certificate expires, applications that are using that certificate will not be authenticated successfully.

The options supported by the OpenSSL req utility are as follows:

-inform arg 

Input format-one of Der TXT PEM

arg output format - one of DER TXT PEM 
-in arg 
inout file 
-out arg 
output file 


Text form of request

do not output REQ 
verify signature on REQ 
RSA modulus 


Do not encrypt the output key

-Key File

use the private key contained in file 

-Keyform ARG

key file format 

-Keyout ARG

File to send the key

-Newkey RSA: bits

generate a new RSA key of `bits' in size 

-Newkey DSA: File

Generate a new DSA key, parameters taken from CA in 'file'


Digest to sign with (md5, sha1, md2, mdc2) 

-Config file

Request Template File


New request


Output an X509 structure instead of a certificate Req. (used for creating self signed certificates)


Number of days an X509 generated by-X509 is valid


Output the `request' in a format that is wrong but some CA's have been reported as requiring [It is now always turned on but can be turned off with -no-asn1-kludge] 


Using the req Utility

To create a self-signed certificate with an expiry date a year from now, the req utility can be used as follows to create the certificate ca_cert.pem and the corresponding encrypted private key file ca_pk.pem:

openssl req -config ssl_conf_path_name -days 365  -out CA_cert.pem -new -x509 -keyout CA_pk.pem 

This following command creates the certificate request myreq. PEM and the corresponding encrypted private key file myencryptedkey. pem:

openssl req -config ssl_conf_path_name -days 365 -out MyReq.pem -new -keyout MyEncryptedKey.pem 
The RSA Utility

The RSA command is a useful utility for examining and modifying RSA private key files. generally RSA keys are stored encrypted with a specified Ric algorithm using a user-supplied pass phrase. the OpenSSL req command prompts the user for a pass phrase in order to encrypt the private key. by default, req uses the Triple DES algorithm. the RSA command can be used to change the password that protects the private key and to convert the format of the private key. any RSA command that involves reading an encrypted RSA private key will prompt for the PEM pass phrase used to encrypt it.

The options supported by the OpenSSL RSA utility are as follows:

-Inform ARG

Input format-one of Der net PEM

-Outform ARG

Output format-one of Der net PEM


Inout File

-Out ARG

Output file


Encrypt PEM output with CBC des


Encrypt PEM output with Ede CBC des using 168 bit key


Print the key in text


Do not print key out


Print the RSA key Modulus


Using the RSA Utility

Converting a private key to PEM format from der format involves using the RSA utility as follows:

openssl rsa -inform DER -in MyKey.der -outform PEM -out MyKey.pem 

Changing the pass phrase which is used to encrypt the private key involves using the RSA utility as follows:

openssl rsa -inform PEM -in MyKey.pem -outform PEM -out MyKey.pem -des3 

Removing encryption from the private key (which is not recommended) involves using the RSA command utility as follows:

openssl rsa -inform PEM -in MyKey.pem -outform PEM -out MyKey2.pem 

Do not specify the same file for the-in and-out parameters, because this can upload upt the file.

The CA Utility

You can use the CA utility create X.509 certificates by signing existing signing requests. it is imperative that you check the details of a certificate request before signing. your organization shocould have a policy with respect to the issuing of certificates. before implementing cas, refer to managing certificates for more information.

The CA utility is used to sign certificate requests thereby creating a valid X.509 Certificate which can be returned to the request submitter. it can also be used to generate Certificate Revocation Lists (crls ). for information on the ca-policy and-name options, refer to "The OpenSSL configuration file" On page? 117.

To create a new CA using the OpenSSL ca utility, two files (Serial and index.txt) need to be created in the location specified by the OpenSSL configuration file that you are using.

The options supported by the OpenSSL ca utility are as follows:


-Talk alot while doing things

-Config file

-A Config File

-Name ARG

-The participating ca definition to use


-Generate a new CRL

-Crldays days

-Days is when the next CRL is due

-Crlhours hours

-Hours is when the next CRL is due

-Days ARG

-Number of days to certify the Certificate


-MD to use, one of md2, MD5, Sha or sha1

-Policy ARG

-The ca 'policy' to support

-Keyfile ARG

-PEM Private Key File

-Key ARG

-Key to decode the private key if it is encrypted


-The CA certificate

-In File

-The input PEM encoded certificate request (s)

-Out File

-Where to put the output file (s)

-Outdir dir

- Where to put output certificates 

-Infiles ....

-The last argument, requests to process

-Spkac File

-File contains DN and signed public key and challenge


-Do not re-order the DN


-Do not ask questions


- msie modifications to handle all thos universal strings 


Most of the above parameters have default values as defined in OpenSSL. CNF.

Using the CA Utility

Converting a private key to PEM format from der format involves using the CA utility as shown in the following example. to sign the supplied CSR myreq. PEM to be valid for 365 days and create a new X.509 Certificate in PEM format, use the CA utility as follows:

openssl ca -config ssl_conf_path_name -days 365 -in MyReq.pem -out MyNewCert.pem 

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.