SSL – Rage Against the Shell

First generate the key, at least with 2048 encryption bits:

~ $ openssl genrsa -out server.com.key 2048

Second generate the csr using the above key:

~ $ openssl req -new -key server.com.key -out server.com.csr

Answer to the questions:

Country Name (2 letter code) [AU]:GL
State or Province Name (full name) [Some-State]:Your state
Locality Name (eg, city) []:Your city
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Your company
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:server.com
Email Address []:[email protected]

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Finally signed the csr with the key:

~ $ openssl x509 -req -days 365 -in server.com.csr -signkey server.com.key -out server.com.crt

Also you can do all steps in a single one:

~ $ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout server.com.key -out server.com.crt

All info from a CSR file:

~ $ openssl req -noout -text -in www.mydomainssl.com.csr

All info from a CRT file:

~ $ openssl x509 -noout -text -in www.mydomainssl.com.crt

Expiration date:

~ $ openssl x509 -noout -dates -in www.mydomainssl.com.csr

Verify the CSR file:

~ $ openssl req -verify -in www.mydomainssl.com.csr

Verify the KEY:

~ $ openssl rsa -check -in www.mydomainssl.com.key

Compare the md5 KEY, CSR and CRT to check if they match:

~ $ openssl rsa -noout -modulus -in www.mydomainssl.com.key | openssl md5
~ $ openssl req -noout -modulus -in www.mydomainssl.com.csr | openssl md5
~ $ openssl x509 -noout -modulus -in www.mydomainssl.com.crt | openssl md5

Extract secure HTTP info remotely:

~ $ openssl s_client -showcerts -connect www.mydomainssl.com:443

Extract secure SMTP info remotely:

~ $ openssl s_client -showcerts -connect www.mydomainssl.com:465

M	T	W	T	F	S	S
				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30	31

Category: SSL

Generate a self-signed SSL cert

Extract info from a SSL cert