CATEGORY -CRYPTOGRAPHYopenssl-pki-cheatsheetModern Cryptographic Primitives

OpenSSL PKI, Keys & TLS Diagnostics

Practical command recipes for generating modern RSA/Ed25519 keypairs, CSRs, self-signed certificates, and troubleshooting TLS handshakes.

Core Purpose & Operating Context

Essential cryptographic recipes for certificate lifecycle management and live TLS connection inspection.

01.

Certificate & Key Management

Generating and inspecting X.509 cryptographic assets.

Generate a self-signed X.509 certificate and unencrypted 4096-bit RSA private key

$openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

Inspect subject, issuer, validity dates, and SAN entries on an existing certificate

$openssl x509 -in cert.pem -text -noout

Initiate live TLS handshake, display server certificate chain, and test cipher negotiation

$openssl s_client -connect example.com:443 -servername example.com

•

Always protect private key files with strict permissions (chmod 600 or 400).

•

Modern TLS configurations should disable SSLv3, TLS 1.0, and TLS 1.1, enforcing TLS 1.2 and TLS 1.3 only.