Select a result to preview

SSL Certificates Cheat-Sheet

X.509 is an ITU standard defining the format of public key certificates. X.509 are used in TLS/SSL, which is the basis for HTTPS. An X5.09 certificate binds an identity to a public key using a digital signature. A certificate contains an identity (hostname, organization, etc.) and a public key (RSA, DSA, ECDSA, ed25519, etc.) and is either signed by a Certificate Authority or is Self-Signed.

Self-Signed Certificates

Generate CA

  1. Generate RSA
    openssl genrsa -aes256 -out ca-key.pem 4096

  2. Generate a public CA Cert
    openssl req -new -x509 -sha256 -days 365 -key ca-key.pem -out ca.pem

Generate Certificate

  1. Create a RSA key
    openssl genrsa -out cert-key.pem 4096

  2. Create a Certificate Signing Request (CSR)
    openssl req -new -sha256 -subj "/CN-yourcn" -key cert-key.pem -out cert.csr

  3. Create a extfile with all the alternative names

echo "subjectAltName=DNS:your-dns.record,IP:257.10.10.1" >> extfile.cnf 

# optional
echo extendedKeyUsage = serverAuth >> extfile.cnf
  1. Create the certificate
openssl x509 -req -sha256 -days 365 -in cert.csr -CA ca.pem -CAkey ca-key.pem -out cert.pem -extfile extfile.cnf -CAcreateserial

Certificate Formats

X.509 Certificates exist in Base64 Formats PEM (.pem, .crt, .ca-bundle), PKCS#7 (.p7b, p7s) and Binary Formats DER (.der, .cer), PKCS#12 (.pfx, p12).

Convert Certs