Certificate Inspector - House of the Key

View Certificate Details

openssl x509 -in certificate.crt -text -noout

Convert PEM to DER Format

openssl x509 -in cert.pem -outform DER -out cert.der

Convert DER to PEM Format

openssl x509 -in cert.der -inform DER -outform PEM -out cert.pem

Verify Certificate Chain

openssl verify -CAfile ca-bundle.crt -untrusted intermediate.crt server.crt

Check Certificate Expiration Date

openssl x509 -in certificate.crt -noout -enddate

Extract Public Key from Certificate

openssl x509 -in certificate.crt -noout -pubkey > public.key

Generate Private Key and CSR (RSA 2048-bit)

openssl req -newkey rsa:2048 -nodes -keyout private.key -out request.csr

Generate Private Key and CSR (ECDSA P-256)

openssl ecparam -genkey -name prime256v1 | openssl req -new -key /dev/stdin -out request.csr

View CSR Details

openssl req -in request.csr -text -noout

Test SSL/TLS Connection

openssl s_client -connect example.com:443 -servername example.com

Download and View Server Certificate

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -text -noout

Verify Certificate and Private Key Match

openssl x509 -noout -modulus -in certificate.crt | openssl md5 openssl rsa -noout -modulus -in private.key | openssl md5

Check OCSP Status

openssl ocsp -issuer issuer.crt -cert server.crt -url http://ocsp.example.com -resp_text

Create Self-Signed Certificate (1 year validity)

openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365

Extract Certificate from PKCS#12/PFX

openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.crt

Extract Private Key from PKCS#12/PFX

openssl pkcs12 -in certificate.pfx -nocerts -nodes -out private.key

Convert PEM to PKCS#12/PFX

openssl pkcs12 -export -in certificate.crt -inkey private.key -out certificate.pfx

Calculate Certificate Fingerprint (SHA-256)

openssl x509 -in certificate.crt -noout -fingerprint -sha256

Generate Certificate Signing Request