Loading Techie Utils…

OpenSSL Command Generator

Build the command, read one somebody sent you, and check a key against its certificate. Free, and runs entirely in your browser — nothing is uploaded.

About OpenSSL Helper

OpenSSL is thirty years old, has hundreds of subcommands, and its argument order is inherited rather than designed. Nobody remembers -newkey rsa:2048 -noenc -keyout in the right order — and the failure mode of getting it wrong is rarely an error. It is a file that is quietly the wrong thing: an encrypted key where the server wanted a plain one, or a certificate with no subject alternative name, which every browser made since 2017 refuses outright.

So this builds the command for what you are actually trying to do, and explains every flag it used. It reads commands the other way too — the ones that circulate in issue threads and runbooks get copied far more often than they get read, and some are years out of date: -des3 on a key, a -sha1 signature, an s_client with no -servername that silently tests the wrong virtual host.

The third thing it does is the chore everybody looks up the same incantation for: whether a private key actually belongs to a certificate. That is answered here directly by comparing the public keys, rather than by printing two hashes for you to compare by eye — and unlike the modulus trick, it works for elliptic-curve keys, which is where the old recipe quietly prints nothing useful.

Each command is shown next to what running it prints. That matters more than it sounds: several of these are silent when they succeed, so a reader who has not seen that before cannot tell a finished genpkey from a hung one — and the commands that do print something print several screens of it, with the one line you wanted somewhere in the middle. The sample says which line that is, and what a certificate, a request or a key file looks like when it lands.

Nothing here runs OpenSSL. A browser cannot, and a site that offered to would be asking you to upload a private key. The commands are for you to run; the output beside them is an illustration of what to expect, not a run of anything; and the key-against-certificate comparison happens in this tab.

Where it helps

  • Builds the command for the task rather than making you assemble flags whose order is historical.
  • Explains every flag it used, so the command teaches you something instead of being pasted blindly.
  • Reads a command somebody else wrote and names the parts that are withdrawn — Triple DES, SHA-1, a missing -servername.
  • Checks a private key against its certificate or request by comparing public keys, which works for elliptic curves as well as RSA.
  • Warns about the two things most easily forgotten: a missing subject alternative name, and a key encrypted when the server needs it plain.
  • Shows what each command prints and what the file it writes looks like, including the failure output — which is the part people are usually staring at.
  • Covers the jobs around the certificate as well as the certificate: running a small authority, signing a request with it, checking revocation, expiry monitoring, fingerprints and pins, random material, and a file hashed or signed.
  • Nothing is uploaded — the comparison runs in this tab and the commands are only ever text.

Limits

  • It does not run OpenSSL, so it cannot tell you whether your build supports a flag or what your files actually contain.
  • The output shown beside each command is an illustration with made-up names and dates in it, not a run. Use it to know where to look, not as something to diff against.
  • Flag spellings differ between versions — -nodes became -noenc in OpenSSL 3.0, and -addext needs 1.1.1 or newer.
  • An encrypted private key cannot be compared until it is decrypted, because nothing here asks for a passphrase.
  • It covers the subcommands people paste, not all of them; openssl help remains the complete list.

Frequently asked questions

Why does my certificate not work even though the common name is right?

Because nothing reads the common name any more. Every browser since 2017 looks only at the subject alternative name list, so the name has to appear there — repeated, even when it is already the common name.

What is the difference between -nodes and -noenc?

Nothing. -noenc is the OpenSSL 3.0 spelling of -nodes, which meant 'no DES' back when DES was the default encryption for a private key. Both leave the key unencrypted so a server can start without someone typing a passphrase.

Is the output shown real?

No — nothing here runs OpenSSL, and a page that offered to would be asking you to upload a private key. The output is written out to show the shape of it: which line carries the answer, what a silent success looks like, and how the common failures read. The names, dates and serial numbers in it are invented.

I signed a certificate with my own CA and the browser still refuses it. Why?

Almost certainly because openssl x509 -req copies nothing out of the request unless you tell it to, so the certificate came out with no subject alternative name. It will pass openssl verify quite happily — verify does not care about names. The sign task here writes the extension file first for that reason.

How do I check that a key matches a certificate?

Use the compare mode here: paste the key in one box and the certificate in the other. The old recipe compares the RSA modulus through md5, which works but prints nothing useful for an elliptic-curve key — this compares the public keys directly, so it works for both.

Why does s_client show the wrong certificate?

Almost always a missing -servername. Without it no SNI is sent, and a server hosting several sites answers with whichever certificate it treats as the default — so you inspect the wrong one and conclude the host is misconfigured.

Should I still use genrsa?

It works, but genpkey supersedes it and handles every key type with one set of flags, including the elliptic curves that genrsa cannot make at all.

Related tools

More SSL & Certificates tools