openssl commands: key, CSR and certificate checks

On shared hosting, a free certificate is issued automatically. The commands below are useful if you buy a certificate, install it on your own server or are working out why it isn’t working. Replace example.com with your own domain.

Key and certificate signing request

openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr -subj "/CN=example.com"

This creates two files. .csr is the request — you send it to whoever you are buying the certificate from. .key is the private key and must stay with you. On shared hosting you can also create a request without commands: cPanel → SSL/TLS → Certificate Signing Requests.

What is inside the files

openssl req -in example.com.csr -noout -text
openssl x509 -in example.com.crt -noout -subject -issuer -dates -ext subjectAltName

The second command shows which names the certificate was issued for, who issued it and when it expires.

Does the key match the certificate?

openssl x509 -in example.com.crt -noout -pubkey | openssl sha256
openssl pkey -in example.com.key -pubout | openssl sha256

If the two lines match, the key and the certificate are a pair.

Which certificate a website is serving

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

For email, use -connect mail.example.com:993 or :465, and for port 587 add -starttls smtp.

PFX for Windows

Windows and IIS want the certificate and key in a single .pfx file:

openssl pkcs12 -export -in example.com.crt -inkey example.com.key -certfile chain.crt -out example.com.pfx

chain.crt contains the intermediate certificates, which are provided by whoever issued the certificate.