OpenSSL Cheat Sheet

Generate / Manage Keys & Certs

• Generate RSA private key openssl genrsa -out key.pem 2048
• Generate EC key openssl ecparam -genkey -name prime256v1 -out ec.key
• Create a self-signed cert openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes
• CSR from key openssl req -new -key key.pem -out req.csr
• View cert details openssl x509 -in cert.pem -text -noout
• View CSR openssl req -in req.csr -text -noout
• Convert formats openssl x509 -in cert.pem -outform der -out cert.der (PEM→DER)

Connect & Test Server TLS

• Handshake + print cert openssl s_client -connect host:443 </dev/null
• Show server cert only openssl s_client -connect host:443 -showcerts </dev/null | openssl x509 -text -noout
• SNI for hosts on shared IP openssl s_client -connect 1.2.3.4:443 -servername host </dev/null
• Test specific protocol/version openssl s_client -connect host:443 -tls1_2 (-tls1_1, -tls1, -ssl3 for legacy checks)
• Test cipher openssl s_client -connect host:443 -cipher 'ECDHE-RSA-AES256-GCM-SHA384'
• List supported ciphers openssl ciphers -v 'HIGH:!aNULL' / -s server ciphers openssl s_client -connect host:443 </dev/null | openssl ciphers -v

Encryption / Decryption (symmetric)

• AES-256-CBC file encrypt openssl enc -aes-256-cbc -salt -in plain.txt -out enc.bin
• Decrypt openssl enc -d -aes-256-cbc -in enc.bin -out plain.txt
• Base64 armor -a (add to both directions)

PKI Operations

• Sign a CSR openssl x509 -req -in req.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out new.pem -days 365
• Verify chain openssl verify -CAfile ca.pem cert.pem
• Retrieve cert chain (for JARM/fingerprint tasks) openssl s_client -connect host:443 -showcerts </dev/null
• Diffie-Hellman params openssl dhparam -out dh.pem 2048

Decrypting Something You Found

• Attempt to decode a base64 blob → openssl enc guess not needed; use xxd/file first
• Many CTF encrypted files: try common algos openssl enc -d -aes-256-cbc -pbkdf2 -in data -out out.bin

Misc Security Uses

• Fingerprint cert (SHA-1/SHA-256) openssl x509 -in cert.pem -fingerprint -noout
• Extract public key openssl rsa -in key.pem -pubout -out pub.pem
• Test weak DH/export ciphers on legacy targets openssl s_client -connect host:443 -cipher 'EXPORT' (usually refused — good)

Common Gotchas

• -pbkdf2 avoids “unsupported” warnings on newer OpenSSL
• Always pass -nodes to avoid being prompted for empty passphrases in scripts
• Check expiration date for cert-lifetime findings openssl x509 -in cert.pem -noout -enddate