🔐 OpenSSL Command Generator
Generate OpenSSL commands: self-signed certs, CSRs, certificate inspection, key management, and protocol testing.
About this tool
This tool generates common OpenSSL commands: self-signed certificates, certificate signing requests (CSR), certificate inspection, key generation, format conversion, and TLS connection testing. Instead of memorizing OpenSSL flags, you configure the parameters in a form and get a ready-to-run command.
Self-signed certs are useful for local development and internal services. CSRs are what you submit to Certificate Authorities (CA) like Let's Encrypt to get a publicly-trusted certificate. Certificate inspection helps you verify expiry dates, issuer, and other fields. Key generation covers RSA and ECDSA options.
Example: create a self-signed cert for example.com valid for 365 days with RSA-2048 and you get openssl req -new -x509 -newkey rsa:2048 -days 365 -keyout cert.key -out cert.crt -subj "/CN=example.com" — just paste it into your terminal.
FAQ
Is OpenSSL pre-installed? ›
OpenSSL is pre-installed on most Linux distributions and macOS. Windows users can install it via Chocolatey (<code>choco install openssl</code>), WSL, or Git Bash.
How long should my certificate be valid? ›
For production, most CAs issue certificates valid for 90 days (Let's Encrypt) or 1 year. Self-signed certificates for development can be 1-5 years. Shorter validity is recommended for security — expired certs are a common source of outages.
Should I use RSA or ECDSA? ›
ECDSA (P-256) is generally preferred for new applications — it provides equivalent security to RSA-3072 with smaller keys and faster operations. RSA 2048 is still widely supported and perfectly fine. Use RSA 4096 only if you need maximum compatibility with legacy systems.
How do I convert a certificate to PEM? ›
Most certificates are already in PEM format. If you have DER (binary), use <code>openssl x509 -inform DER -in cert.der -outform PEM -out cert.pem</code>. For PKCS#12/PFX files, use <code>openssl pkcs12 -in cert.pfx -out cert.pem -nodes</code>.