openssl 실전 — 인증서 생성, 확인, 변환

# 원격 서버 인증서 확인
openssl s_client -connect example.com:443 -showcerts </dev/null

# 만료일만 빠르게 확인
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

# 로컬 인증서 파일 확인
openssl x509 -in cert.pem -noout -text

# 주요 정보만
openssl x509 -in cert.pem -noout -subject -issuer -dates

# 인증서 지문 (fingerprint)
openssl x509 -in cert.pem -noout -fingerprint -sha256

# 개인키 + 인증서 한 번에 생성 (365일)
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/C=KR/ST=Seoul/L=Seoul/O=MyOrg/CN=localhost"

# SAN 포함 (크롬 호환)
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

# 개인키 생성
openssl genrsa -out server.key 4096

# CSR 생성
openssl req -new -key server.key -out server.csr \
  -subj "/C=KR/ST=Seoul/O=MyCompany/CN=example.com"

# CSR 내용 확인
openssl req -in server.csr -noout -text

# PEM → DER (바이너리)
openssl x509 -in cert.pem -outform der -out cert.der

# DER → PEM
openssl x509 -in cert.der -inform der -out cert.pem

# PEM → PFX/P12 (Windows/IIS용)
openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem \
  -certfile chain.pem -passout pass:mypassword

# PFX → PEM
openssl pkcs12 -in cert.pfx -out cert.pem -nodes -passin pass:mypassword

# 개인키 암호 제거
openssl rsa -in encrypted.key -out decrypted.key

#!/bin/bash
DOMAINS=("example.com" "api.example.com")
WARN_DAYS=30

for domain in "${DOMAINS[@]}"; do
  expiry=$(echo | openssl s_client -connect "$domain:443" 2>/dev/null \
    | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)

  if [ -z "$expiry" ]; then
    echo "FAIL: $domain (연결 불가)"
    continue
  fi

  days=$(( ($(date -d "$expiry" +%s) - $(date +%s)) / 86400 ))

  if [ "$days" -lt "$WARN_DAYS" ]; then
    echo "WARNING: $domain — ${days}일 후 만료"
  else
    echo "OK: $domain — ${days}일 남음"
  fi
done