🛠️ OpenSSL Command Builder

🎯 Preset

{{ (presetList.find(p => p.id === selectedPreset) || {}).description || '' }}

📂 Category

{{ currentCategoryDef.description }}

⚡ Quick example

📝 Parameters

No parameters required.

{{ field.description }}

📤 Generated command

{{ command || '# Pick a category and fill in fields to generate an openssl command.' }}

⚠️ Warnings

  • {{ w }}

📁 Files this command reads / writes

  • {{ f.name }} [{{ f.role }}] — {{ f.description }}

📖 Flag-by-flag explanation

Flag Meaning
{{ e.flag }} {{ e.meaning }}
⚠️

ℹ️ About OpenSSL Command Builder

What is the OpenSSL Command Builder?

OpenSSL is the de facto Swiss-army knife for everything cryptographic on the command line: generate keys, issue certificate signing requests, self-sign certificates, bundle keys into PKCS#12 / PFX, probe remote TLS endpoints, hash files, encrypt with a passphrase, generate random secrets, and more. The flag surface area is huge and inconsistent between sub-commands (genrsa, genpkey, req, x509, pkcs12, dgst, enc, rand, s_client, verify) and the official manual scatters the answers across a dozen man pages.

This builder turns a small form into the exact openssl … command line you need to run, with every flag explained inline, every file the command reads or writes listed, and warnings raised for weak or deprecated choices (RSA 1024, SHA-1 signatures, 3DES, -nodes plaintext keys, missing SANs, etc.). It does NOT execute the command — you copy and paste the result into your own shell.

Categories this builder covers

  • Generate private key — openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out private.key or EC / Ed25519 / Ed448.
  • Certificate Signing Request (CSR) — openssl req -new -key private.key -out request.csr -subj "..." -addext "subjectAltName=DNS:..." with Subject Alternative Names baked in (browsers require SAN; CN is ignored).
  • Self-signed certificate — openssl req -x509 -newkey rsa:4096 -keyout private.key -out cert.pem -days 365 -nodes -subj "...".
  • Sign a file — openssl dgst -sha256 -sign private.key -out message.sig message.txt.
  • Hash a file — openssl dgst -sha256 file.bin.
  • Encrypt / decrypt with passphrase — openssl enc -aes-256-cbc -pbkdf2 -iter 100000 -a -in plaintext.txt -out ciphertext.txt.
  • PKCS#12 / PFX bundle — openssl pkcs12 -export -out keystore.p12 -inkey private.key -in cert.pem -name mykey -password pass:<password>.
  • Inspect a cert / CSR / key / PKCS#12 — openssl x509 -in cert.pem -text -noout, etc.
  • Probe remote TLS endpoint — openssl s_client -connect host:443 -servername host -showcerts with optional STARTTLS for SMTP / IMAP / POP3 / FTP / XMPP / LDAP / PostgreSQL / MySQL.
  • Verify cert chain — openssl verify -CAfile ca-bundle.pem cert.pem.
  • Generate random secret — openssl rand -base64 32 or -hex 16.
  • Local TLS test server — openssl s_server -cert cert.pem -key private.key -accept 4433 -www.

Crypto strength ratings used by this tool

  • RSA — 1024-bit is broken (factorization within reach of well-funded adversaries; SECURITY STATUS: Broken); 2048-bit is the modern minimum (Strong, expected to remain safe through 2030); 3072-bit / 4096-bit are preferred for long-lived CAs (Strong, recommended).
  • EC P-256 (prime256v1) — Strong, recommended. P-384 / P-521 for higher security margins. secp256k1 is the Bitcoin curve — not for TLS.
  • Ed25519 / Ed448 — modern EdDSA curves, Strong, recommended where supported (TLS 1.3, modern SSH, signing).
  • SHA-256 / SHA-384 / SHA-512 — Strong, recommended for signatures and digests.
  • SHA-1 — Deprecated for digital signatures (SHAttered collision attack, 2017). Acceptable only for backward-compatible non-security contexts (Git, legacy HMAC).
  • MD5 — Cryptographically broken for signatures. Never use for authentication or integrity.
  • AES-256-CBC / AES-256-GCM / ChaCha20 — Strong, recommended. AES-GCM is authenticated (preferred when both confidentiality and integrity matter).
  • 3DES / DES-EDE3 — Obsolete (NIST disallows after 2023); use AES.
  • DES / RC4 / RC2 — Broken. Never use.

When to use which OpenSSL sub-command

  • genpkey — modern unified key generator. Replaces genrsa, ecparam -genkey, dsaparam. Use genpkey for all new keys.
  • req — generate a CSR, OR with -x509 generate a self-signed certificate, OR with -newkey generate the key in the same step.
  • x509 — display, sign, convert, or self-issue X.509 certificates from existing CSRs / keys. -text -noout is the canonical inspection form.
  • pkcs12 — bundle (-export) or extract a PKCS#12 keystore. Used to wrap key + cert + CA chain into a single .p12 / .pfx file for Java, Windows, or browser import.
  • dgst — hash files, OR sign (-sign) / verify (-verify) signatures using a private/public key.
  • enc — symmetric encryption with passphrase-derived key. Always use -pbkdf2 -iter 100000 (or more) — the legacy EVP_BytesToKey KDF (single MD5 round) is broken.
  • rand — pull cryptographically-secure random bytes from the OS RNG and output as raw, hex, or base64.
  • s_client — TLS client for probing remote endpoints. The -connect host:port, -servername host, and -showcerts combo is the universal "show me the cert chain" recipe.
  • s_server — minimal TLS server for client testing. NEVER use for production.
  • verify — verify a certificate chains to a trusted CA bundle.

Source references

API Usage Example:

POST /api/tools/security/openssl-command-builder
Content-Type: application/json

{
    "category": "keygen",
    "fields": {
        "algorithm": "rsa-4096",
        "outFile": "private.key"
    }
}
Ready