OpenSSL Command Builder
Pick a task and get the OpenSSL 3 command for it: generate keys and CSRs, read and convert certificates, check expiry and chains, test TLS on a server, bundle PKCS#12 files.
Free · No sign-up · Your inputs stay in your browser
Input
Find the openssl command for a task
Output
Show a server's certificate
138 characters
Written for OpenSSL 3, where genpkey and pkey replace the per-algorithm genrsa and rsa commands. -servername sends SNI: without it, a server hosting several sites returns its default certificate, which is the usual reason s_client shows the wrong one. macOS ships LibreSSL as openssl, which lacks some options; Homebrew's openssl@3 has them all.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
OpenSSL 3 syntax
OpenSSL 3 prefers the generic genpkey and pkey commands over the per-algorithm genrsa, rsa and ec ones, which are deprecated. The commands here use the current forms. The OpenSSL 3 manual pages document each subcommand.
The flags people forget
-servername with s_client sends SNI; without it a server that hosts several sites returns its default certificate and you debug the wrong one. -nodes (or -noenc) leaves a key unencrypted, which a web server needs to start without a prompt. macOS ships LibreSSL as openssl, which lacks some options; Homebrew's openssl@3 has them.
