SSL – Rage Against the Shell

First generate the key, at least with 2048 encryption bits:

~ $ openssl genrsa -out server.com.key 2048

Second generate the csr using the above key:

~ $ openssl req -new -key server.com.key -out server.com.csr

Answer to the questions:

Country Name (2 letter code) [AU]:GL
State or Province Name (full name) [Some-State]:Your state
Locality Name (eg, city) []:Your city
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Your company
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:server.com
Email Address []:webmaster@server.com

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Finally signed the csr with the key:

~ $ openssl x509 -req -days 365 -in server.com.csr -signkey server.com.key -out server.com.crt

Also you can do all steps in a single one:

~ $ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout server.com.key -out server.com.crt

All info from a CSR file:

~ $ openssl req -noout -text -in www.mydomainssl.com.csr

All info from a CRT file:

~ $ openssl x509 -noout -text -in www.mydomainssl.com.crt

Expiration date:

~ $ openssl x509 -noout -dates -in www.mydomainssl.com.csr

Verify the CSR file:

~ $ openssl req -verify -in www.mydomainssl.com.csr

Verify the KEY:

~ $ openssl rsa -check -in www.mydomainssl.com.key

Compare the md5 KEY, CSR and CRT to check if they match:

~ $ openssl rsa -noout -modulus -in www.mydomainssl.com.key | openssl md5
~ $ openssl req -noout -modulus -in www.mydomainssl.com.csr | openssl md5
~ $ openssl x509 -noout -modulus -in www.mydomainssl.com.crt | openssl md5

Extract secure HTTP info remotely:

~ $ openssl s_client -showcerts -connect www.mydomainssl.com:443

Extract secure SMTP info remotely:

~ $ openssl s_client -showcerts -connect www.mydomainssl.com:465

M	T	W	T	F	S	S
						1
2	3	4	5	6	7	8
9	10	11	12	13	14	15
16	17	18	19	20	21	22
23	24	25	26	27	28	29
30	31

Category: SSL

Generate a self-signed SSL cert

Extract info from a SSL cert