Openssl - Revision history

Tony: /* Generate a signing request (CSR) */

2026-06-08T08:00:05Z

Generate a signing request (CSR)

← Older revision		Revision as of 08:00, 8 June 2026
Line 74:		Line 74:
	openssl req -nodes -newkey rsa:2048 -keyout $N.key -out $N.csr		openssl req -nodes -newkey rsa:2048 -keyout $N.key -out $N.csr

			openssl req -utf8 -nodes -sha256 -newkey rsa:2048 -keyout server.key -out server.csr
	The resulting csr is the signing request, my.domain.key is the private key you save not readable for anyone but root!		The resulting csr is the signing request, my.domain.key is the private key you save not readable for anyone but root!

Tony: /* Examining certificates */

2026-03-31T10:57:44Z

Examining certificates

← Older revision		Revision as of 10:57, 31 March 2026
Line 119:		Line 119:
	openssl x509 -in cacert.pem -noout -text		openssl x509 -in cacert.pem -noout -text
	openssl x509 -in foo.pem -inform pem -noout -text		openssl x509 -in foo.pem -inform pem -noout -text


	openssl rsa -noout -text -in server.key		openssl rsa -noout -text -in server.key
			===Read contents of crt===
			openssl x509 -noout -text -in ca.crt
			===Read contents of csr===
	openssl req -noout -text -in server.csr		openssl req -noout -text -in server.csr

	openssl rsa -noout -text -in ca.key		openssl rsa -noout -text -in ca.key
	~~openssl x509 -noout -text -in ca.crt~~

	with expiration date:		with expiration date:
Line 135:		Line 140:
	openssl pkcs12 -info -in keyStore.p12		openssl pkcs12 -info -in keyStore.p12
	openssl pkcs12 -info -in keyStore.pfx		openssl pkcs12 -info -in keyStore.pfx



	== Checking a service ==		== Checking a service ==

Tony: /* Generate a signing request */

2026-03-05T14:21:53Z

Generate a signing request

← Older revision		Revision as of 14:21, 5 March 2026
Line 70:		Line 70:
	COMODORSAOrganizationValidationSecureServerCA. + COMODO rsa add trust ca ( + addtrustexternalcaroot )		COMODORSAOrganizationValidationSecureServerCA. + COMODO rsa add trust ca ( + addtrustexternalcaroot )

	=== Generate a signing request ===		=== Generate a signing request (CSR)===
			N=my.domain
	openssl req -nodes -newkey rsa:2048 -keyout ~~my.domain~~.key -out ~~my.domain~~.csr		openssl req -nodes -newkey rsa:2048 -keyout $N.key -out $N.csr

	The resulting csr is the signing request, my.domain.key is the private key you save not readable for anyone but root!		The resulting csr is the signing request, my.domain.key is the private key you save not readable for anyone but root!

Tony: /* HOWTO */

2026-02-06T16:17:27Z

HOWTO

← Older revision		Revision as of 16:17, 6 February 2026
Line 203:		Line 203:

	Convert to p12		Convert to p12

			==Get issuer==
			openssl s_client -showcerts -connect <YOURHOST>:443 < /dev/null 2>/dev/null \|grep -i issuer
			or better:
			openssl s_client -showcerts -connect YOURHOST:443 -servername YOURHOST -showcerts </dev/null \| openssl x509 -nouout -issuer
			and even
			openssl s_client -servername $H -host $H -port 443 -showcerts </dev/null 2>/dev/null\| openssl x509 -noout -issuer \| sed 's/.* O = $.$, CN./\1/'

	= FAQ =		= FAQ =

Tony: /* Get issuer */

2026-02-06T16:16:47Z

Get issuer

← Older revision		Revision as of 16:16, 6 February 2026
Line 238:		Line 238:
	===SSL: error:13800076:OCSP routines::signer certificate not found===		===SSL: error:13800076:OCSP routines::signer certificate not found===
	?		?

	~~==Get issuer==~~
	~~openssl s_client -showcerts -connect <YOURHOST>:443 < /dev/null 2>/dev/null \|grep -i issuer~~
	~~or better:~~
	~~openssl s_client -showcerts -connect YOURHOST:443 -servername YOURHOST -showcerts </dev/null \| openssl x509 -nouout -issuer~~

	== Order of certificates in bundle==		== Order of certificates in bundle==

Tony: /* Get issuer */

2026-02-06T15:30:41Z

Get issuer

← Older revision		Revision as of 15:30, 6 February 2026
Line 241:		Line 241:
	==Get issuer==		==Get issuer==
	openssl s_client -showcerts -connect <YOURHOST>:443 < /dev/null 2>/dev/null \|grep -i issuer		openssl s_client -showcerts -connect <YOURHOST>:443 < /dev/null 2>/dev/null \|grep -i issuer
			or better:
			openssl s_client -showcerts -connect YOURHOST:443 -servername YOURHOST -showcerts </dev/null \| openssl x509 -nouout -issuer

	== Order of certificates in bundle==		== Order of certificates in bundle==
	Root CA comes last		Root CA comes last

Tony: /* Documentation and HOWTOs */

2025-11-25T09:27:55Z

Documentation and HOWTOs

← Older revision		Revision as of 09:27, 25 November 2025
Line 13:		Line 13:

	= Documentation and HOWTOs =		= Documentation and HOWTOs =
			*[https://docs.openssl.org/1.1.1/man1/pkcs12/ pkcs12]
	*[http://sial.org/howto/openssl/ca/ OpenSSL Certificate Authority Setup]		*[http://sial.org/howto/openssl/ca/ OpenSSL Certificate Authority Setup]
	*[http://www.herongyang.com/Cryptography/OpenSSL-Certificate-Path-Validation-Tests.html Validating a Certificate Path with OpenSSL]		*[http://www.herongyang.com/Cryptography/OpenSSL-Certificate-Path-Validation-Tests.html Validating a Certificate Path with OpenSSL]

Tony: /* Create CSR using config file */

2025-11-14T15:29:10Z

Create CSR using config file

← Older revision		Revision as of 15:29, 14 November 2025
Line 94:		Line 94:
	== Create CSR using config file ==		== Create CSR using config file ==

	openssl req -config /etc/pki/tls/www.example.com.cnf -new -newkey rsa:2048 -~~nodes~~ -keyout example.com.key -out www.example.com.csr		openssl req -config /etc/pki/tls/www.example.com.cnf -new -newkey rsa:2048 -noenc -keyout example.com.key -out www.example.com.csr

	==Create .p12==		==Create .p12==
	openssl pkcs12 -export -out keyStore.p12 -inkey myKey.pem -in myCert.cer		openssl pkcs12 -export -out keyStore.p12 -inkey myKey.pem -in myCert.cer

Tony: /* FAQ */

2025-11-07T10:19:25Z

FAQ

← Older revision		Revision as of 10:19, 7 November 2025
Line 204:		Line 204:

	= FAQ =		= FAQ =
			==Should i include the Root CA?==
			Only if server software demands it.

	==Error messages==		==Error messages==
			=== SSL CTX certificate file error: error:0906D06C:PEM routines:PEM_read_bio:no start line ===
			??

			=== 139814102202256:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE ===

			i've seen this happen when someone deleted the BEGIN/END CERTIFICATE lines

			or a file is in DER format

			=== error 20 at 0 depth lookup: unable to get local issuer certificate ===

			you probably need to provide the right -CAfile maybe self signed?


	===self-signed certificate in certificate chain===		===self-signed certificate in certificate chain===
Line 261:		Line 277:
	problem missing CA cert		problem missing CA cert

	~~== error 20 at 0 depth lookup: unable to get local issuer certificate ==~~

	~~you probably need to provide the right -CAfile maybe self signed?~~


Line 275:		Line 288:
	Means the server demands you authenticate with a certificate, and you did not do so, and that caused the handshake failure.		Means the server demands you authenticate with a certificate, and you did not do so, and that caused the handshake failure.

	~~ ~~		== How to check certificate chain? ==

	== check certificate chain ==

	openssl s_client -connect www.example.com:443 -showcerts		openssl s_client -connect www.example.com:443 -showcerts


	~~ ~~

	=== Some of the output ===		=== Some of the output ===
Line 311:		Line 320:
	openssl x509 -enddate -noout -in file.pem		openssl x509 -enddate -noout -in file.pem

	~~== 139814102202256:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:707:Expecting: TRUSTED CERTIFICATE ==~~

	~~i've seen this happen when someone deleted the BEGIN/END CERTIFICATE lines~~

	~~or a file is in DER format~~

	~~== SSL CTX certificate file error: error:0906D06C:PEM routines:PEM_read_bio:no start line ==~~

	??

	~~ ~~

	~~ ~~

	== check if webserver supports old tls ==		== check if webserver supports old tls ==

Tony: /* Links */

2025-11-07T10:14:20Z

Links

← Older revision		Revision as of 10:14, 7 November 2025
Line 4:		Line 4:
	*[http://www.openssl.org/ openssl homepage]		*[http://www.openssl.org/ openssl homepage]
	*[http://gagravarr.org/writing/openssl-certs/index.shtml http://gagravarr.org/writing/openssl-certs/index.shtml]		*[http://gagravarr.org/writing/openssl-certs/index.shtml http://gagravarr.org/writing/openssl-certs/index.shtml]
			*[https://whatsmychaincert.com/ What's My Chain Cert?]


	= Tools =		= Tools =