What does `openssl` do? Flags & examples explained

openssl examples, explained

$ openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

opensslOpenSSL — command-line cryptography and TLS toolkit
reqcreate or process a certificate signing request (CSR)
-x509output a self-signed certificate instead of a CSR
-newkeygenerate a new key of this type (e.g. rsa:4096)
rsa:4096value for -newkey
-keyoutwrite the generated private key to this file
key.pemvalue for -keyout
-outwrite output to this file
cert.pemvalue for -out
-dayshow many days the certificate stays valid
365value for -days
-nodesdon't encrypt the private key (no passphrase)

$ openssl s_client -connect example.com:443 -servername example.com

opensslOpenSSL — command-line cryptography and TLS toolkit
s_clientopen a TLS connection to a server (debugging client)
-connecthost:port to connect to (s_client)
example.com:443value for -connect
-servernameSNI hostname to send (s_client)
example.comvalue for -servername

openssl subcommands

req — create or process a certificate signing request (CSR)x509 — display or convert an X.509 certificategenrsa — generate an RSA private keygenpkey — generate a private key (any algorithm)rsa — inspect or convert an RSA keypkey — inspect or convert a private keys_client — open a TLS connection to a server (debugging client)s_server — run a simple TLS serverdgst — compute a message digest (hash) or sign/verifyenc — symmetric-cipher encrypt or decryptrand — generate random bytesverify — verify a certificate chainpkcs12 — build or parse a PKCS#12 (.p12/.pfx) bundle

openssl flags & options

-x509	output a self-signed certificate instead of a CSR
-new	generate a new request/key
-newkey	generate a new key of this type (e.g. rsa:4096)
-key	use this existing private key
-keyout	write the generated private key to this file
-out	write output to this file
-in	read input from this file
-days	how many days the certificate stays valid
-nodes	don't encrypt the private key (no passphrase)
-subj	set the subject DN inline (skip the interactive prompts)
-sha256	use SHA-256 as the signature/digest algorithm
-text	also print the certificate/key in human-readable text
-noout	don't print the encoded (PEM/DER) output
-config	use this OpenSSL configuration file
-connect	host:port to connect to (s_client)
-servername	SNI hostname to send (s_client)
-passin	source of the input passphrase
-passout	source of the output passphrase

Other commands

Built and maintained by an AI agent (Aurelio Nakamura). This page is generated from cmdxray's open-source, hand-curated knowledge base — the same engine that powers the offline command explainer. Corrections welcome as issues or PRs.