Differences between revisions 3 and 4
Revision 3 as of 2011-02-17 10:55:30
Size: 3026
Editor: SamatJain
Comment: Remove line numbers
Revision 4 as of 2011-04-13 06:45:58
Size: 3164
Editor: SamatJain
Comment: Poor man's benchmark
Deletions are marked like this. Additions are marked like this.
Line 4: Line 4:

== Poor man's benchmark ==

Quick way to compare processing power of CPUs.

{{{#!highlight sh numbers=off
openssl speed sha1
}}}

End-user stuff

Poor man's benchmark

Quick way to compare processing power of CPUs.

openssl speed sha1

Create certificate request/unsigned key

openssl req -nodes -new -keyout blah.key.pem -out blah.req.pem

blah.key.pem will act as an SSLCertificateKeyFile for mod_ssl in Apache

Show key fingerprint

openssl x509 -subject -dates -fingerprint -in blah.key.pem

Generate key

openssl genrsa -out blah.key.pem

Display certificate information

openssl x509 -in blah.crt.pem -noout -text

Creating a PEM file for servers

cat blah.key.pem blah.crt.pem blah.dhp.pem > blah.pem

Used by courier-imap, etc.

Creating a PKCS12-format file

openssl pkcs12 -export -in blah.crt.pem -inkey blah.key.pem -out blah.p12 -name "Bill Gates"

Used for creating certificates used in e-mail clients and web browsers

Signing e-mails

openssl smine -sign -in msg.txt -text -out msg.encrypted -signer blah.crt.pem -inkey blah.key.pem

Certificate Authority stuff

When setting up a new CA on a system, make sure index.txt and serial exist (empty and set to 01, respectively), and create directories private and newcert. Edit openssl.cnf - change default_days, certificate and private_key, possibly key size (1024, 1280, 1536, 2048) to whatever is desired.

Create CA certificate

openssl req -new -x509 -keyout private/something-CA.key.pem -out ./something-CA.crt.pem -days 3650

Export CA certificate in DER format

openssl x509 -in something-CA.crt.pem -outform der -out something-CA.crt

Used by web browsers.

Revoke certificate

openssl ca -revoke blah.crt.pem

Generate Certificate Revocation List (CRL)

openssl ca -gencrl -out crl/hotnudiegirls.com-CA.crl

Sign Certificate Request

openssl ca -out blah.crt.pem -in blah.req.pem

blah.crt.pem acts as SSLCertificateFile for Apache

Create Diffie-Hoffman Parameters for Current CA

openssl dhparam -out hotnudiegirls.com-CA.dhp.pem 1536

Create self-signed certificate from generated key

openssl req -new -x509 -key blah.key.pem -out blah.crt.pem

Use only when you've no CA and will only be generating one key/certificate (useless for anything that requires signed certificates on both ends)

Command-line tricks

Simple file encryption

openssl enc -bf -A -in file_to_encrypt.txt

Simple file decryption

openssl enc -bf -d -A -in file_to_encrypt.txt


CategoryCheatSheet

SamatsWiki: CheatSheet/OpenSSL (last edited 2020-05-04 22:20:10 by SamatJain)