Contents

  1. End-user stuff
    1. Poor man's benchmark
    2. Create certificate request/unsigned key
    3. Show key fingerprint
    4. Generate key
    5. Display certificate information
    6. Creating a PEM file for servers
    7. Creating a PKCS12-format file
    8. Signing e-mails
  2. Certificate Authority stuff
    1. Create CA certificate
    2. Export CA certificate in DER format
    3. Revoke certificate
    4. Generate Certificate Revocation List (CRL)
    5. Sign Certificate Request
    6. Create Diffie-Hoffman Parameters for Current CA
    7. Create self-signed certificate from generated key
  3. Command-line tricks
    1. Simple file encryption
    2. Simple file decryption

End-user stuff

Poor man's benchmark

Quick way to compare processing power of CPUs. 

openssl speed sha1

Create certificate request/unsigned key

openssl req -nodes -new -keyout blah.key.pem -out blah.req.pem

blah.key.pem will act as an SSLCertificateKeyFile for mod_ssl in Apache

Show key fingerprint

openssl x509 -subject -dates -fingerprint -in blah.key.pem

Generate key

openssl genrsa -out blah.key.pem

Display certificate information

openssl x509 -in blah.crt.pem -noout -text

Creating a PEM file for servers

cat blah.key.pem blah.crt.pem blah.dhp.pem > blah.pem

Used by courier-imap, etc.

Creating a PKCS12-format file

openssl pkcs12 -export -in blah.crt.pem -inkey blah.key.pem -out blah.p12 -name "Bill Gates"

Used for creating certificates used in e-mail clients and web browsers

Signing e-mails

openssl smine -sign -in msg.txt -text -out msg.encrypted -signer blah.crt.pem -inkey blah.key.pem

Certificate Authority stuff

When setting up a new CA on a system, make sure index.txt and serial exist (empty and set to 01, respectively), and create directories private and newcert. Edit openssl.cnf - change default_days, certificate and private_key, possibly key size (1024, 1280, 1536, 2048) to whatever is desired.

Create CA certificate

openssl req -new -x509 -keyout private/something-CA.key.pem -out ./something-CA.crt.pem -days 3650

Export CA certificate in DER format

openssl x509 -in something-CA.crt.pem -outform der -out something-CA.crt

Used by web browsers.

Revoke certificate

openssl ca -revoke blah.crt.pem

Generate Certificate Revocation List (CRL)

openssl ca -gencrl -out crl/hotnudiegirls.com-CA.crl

Sign Certificate Request

openssl ca -out blah.crt.pem -in blah.req.pem

blah.crt.pem acts as SSLCertificateFile for Apache

Create Diffie-Hoffman Parameters for Current CA

openssl dhparam -out hotnudiegirls.com-CA.dhp.pem 1536

Create self-signed certificate from generated key

openssl req -new -x509 -key blah.key.pem -out blah.crt.pem

Use only when you've no CA and will only be generating one key/certificate (useless for anything that requires signed certificates on both ends)

Command-line tricks

Simple file encryption

openssl enc -bf -A -in file_to_encrypt.txt

Simple file decryption

openssl enc -bf -d -A -in file_to_encrypt.txt

CategoryCheatSheet