openssl is great tool but it is hard to remember its usage ... here is my summary.
Export public key
openssl pkcs12 -in cert.pfx -clcerts -nokeys -out publicKey.pem
Export private key
openssl pkcs12 -in cert.pfx -nocerts -nodes -out privateKey.pem
Dump certificate
openssl x509 -in cert.cer -noout -text
Convert CER to PEM
openssl x509 -in cert.cer -outform pem -out a.pem
Convert CRL (revocation list file) to PEM format
openssl crl -inform der -in revocationListFile.crl -outform pem -out a.pem
opeopenssl s_client -connect server:443
Try to ask OCSP question (check if certificate revoced)
openssl ocsp -issuer caCert.cer -cert certToCheck.cer -text -url ocspServerUrl
Understand value of SSLCipherSuite
openssl ciphers -v 'HIGH:MEDIUM:!aNULL:!MD5'
PKCS#12 (pfx files)
man page Wikipedia on PKCS12Export public key
openssl pkcs12 -in cert.pfx -clcerts -nokeys -out publicKey.pem
Export private key
openssl pkcs12 -in cert.pfx -nocerts -nodes -out privateKey.pem
X509 (CER files)
man page Wikipedia on X.509Dump certificate
openssl x509 -in cert.cer -noout -text
Convert CER to PEM
openssl x509 -in cert.cer -outform pem -out a.pem
Convert CRL (revocation list file) to PEM format
openssl crl -inform der -in revocationListFile.crl -outform pem -out a.pem
Troublesooting
Try to connect over SSLopeopenssl s_client -connect server:443
Try to ask OCSP question (check if certificate revoced)
openssl ocsp -issuer caCert.cer -cert certToCheck.cer -text -url ocspServerUrl
Understand value of SSLCipherSuite
openssl ciphers -v 'HIGH:MEDIUM:!aNULL:!MD5'
Comments