Practical OpenSSL — Generating, Inspecting, and Converting Certificates

# Inspect a remote server certificate
openssl s_client -connect example.com:443 -showcerts </dev/null

# Quickly check expiry dates only
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

# Inspect a local certificate file
openssl x509 -in cert.pem -noout -text

# Key fields only
openssl x509 -in cert.pem -noout -subject -issuer -dates

# Certificate fingerprint
openssl x509 -in cert.pem -noout -fingerprint -sha256

# Generate private key + certificate in one shot (365 days)
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/C=KR/ST=Seoul/L=Seoul/O=MyOrg/CN=localhost"

# Include SAN (Chrome-compatible)
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

# Generate a private key
openssl genrsa -out server.key 4096

# Generate a CSR
openssl req -new -key server.key -out server.csr \
  -subj "/C=KR/ST=Seoul/O=MyCompany/CN=example.com"

# Inspect CSR contents
openssl req -in server.csr -noout -text

# PEM → DER (binary)
openssl x509 -in cert.pem -outform der -out cert.der

# DER → PEM
openssl x509 -in cert.der -inform der -out cert.pem

# PEM → PFX/P12 (for Windows/IIS)
openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem \
  -certfile chain.pem -passout pass:mypassword

# PFX → PEM
openssl pkcs12 -in cert.pfx -out cert.pem -nodes -passin pass:mypassword

# Strip the passphrase from a private key
openssl rsa -in encrypted.key -out decrypted.key

#!/bin/bash
DOMAINS=("example.com" "api.example.com")
WARN_DAYS=30

for domain in "${DOMAINS[@]}"; do
  expiry=$(echo | openssl s_client -connect "$domain:443" 2>/dev/null \
    | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)

  if [ -z "$expiry" ]; then
    echo "FAIL: $domain (unreachable)"
    continue
  fi

  days=$(( ($(date -d "$expiry" +%s) - $(date +%s)) / 86400 ))

  if [ "$days" -lt "$WARN_DAYS" ]; then
    echo "WARNING: $domain — expires in ${days} days"
  else
    echo "OK: $domain — ${days} days remaining"
  fi
done