OpenSSL Command Generator
Generate copy-paste openssl commands online: create CSRs and self-signed certificates, convert PEM/DER/PKCS12, inspect certs, and check expiry — free,
Loading tool...
What is OpenSSL Command Generator?
OpenSSL Command Generator is a free online tool that assembles ready-to-run openssl command lines for everyday TLS tasks. Choose a mode — CSR creation, self-signed certificates, key format conversion between PEM, DER, and PKCS12, certificate and key inspection, cert-vs-key verification, or expiry checks — fill in your details through a structured form, and copy the exact command to paste into your terminal.
Key Benefits
- Correct flag order and quoting every time, no man-page digging
- Structured subject builder prevents malformed -subj strings
- Modern algorithms included: ECDSA P-256/P-384 and Ed25519
- Private by design — passwords and subjects never leave the browser
Common Use Cases
- •Generate a CSR to submit to a certificate authority
- •Create self-signed certs with SANs for local HTTPS development
- •Bundle a key and certificate chain into a PKCS12 file for Tomcat or IIS
- •Check whether a production endpoint certificate is about to expire
Generate OpenSSL Commands
- Choose a command type: Pick one of the ten modes — CSR, self-signed certificate, PEM to DER key conversion (and back), PKCS#12 export or extraction, inspecting cert/key/CSR, verifying a cert-key pair, or checking expiry.
- Fill in the details: For CSR and self-signed modes, complete the subject fields (C, ST, L, O, OU, CN, email), pick an RSA, EC, or Ed25519 key size, and for self-signed add validity days and subjectAltNames like DNS:example.com.
- Review the command: The command builds live with proper -subj escaping and -addext SAN lines — read the disclaimer noting that the tool never generates keys and any PKCS#12 password stays in your browser.
- Copy and run: Press Copy, paste into your terminal, and keep private keys on your own machine — use Reset to start a new command from the defaults.
Key Features
- 10 command modes: CSR, self-signed, PKCS12, inspection, and expiry checks
- Structured subject builder eliminates quoting mistakes
- subjectAltNames support for multi-domain certificates
- RSA 2048/3072/4096, ECDSA P-256/P-384, and Ed25519 key options
- One-click copy of ready-to-run multi-line commands
- Runs entirely in your browser — nothing is transmitted
Frequently Asked Questions
Which OpenSSL tasks does the generator cover?
Ten modes: CSR creation, self-signed certificates, PEM to DER key conversion (and back), PKCS#12 export and extraction, inspecting certs, keys, and CSRs, verifying that a certificate matches its private key via modulus hashes, and checking expiry locally or against a live endpoint.
Which key algorithms can I choose?
RSA at 2048, 3072, or 4096 bits, ECDSA on the P-256 or P-384 curves, and Ed25519 — emitted as flags like -newkey ec -pkeyopt ec_paramgen_curve:P-256, which give shorter keys and faster handshakes than RSA at comparable strength.
Does the tool run OpenSSL for me?
No — it only composes command text for you to run in a terminal, so no key material is ever generated or transmitted here; the PKCS#12 password you type stays in your browser and is not stored.
Why does the subject use a single -subj flag?
The tool packs C, ST, L, O, OU, CN, and emailAddress into one -subj argument and escapes any slash in your values, so an organization name containing / cannot break the RDN parser or silently drop the remaining fields.