OpenSSL Command Generator
Generate OpenSSL commands for certificates, keys, encryption, and more with an interactive form.
Generated Command
What is the OpenSSL Command Generator?
OpenSSL is a robust, full-featured open-source toolkit that implements the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols, along with a general-purpose cryptography library. Its command-line program can generate keys, create certificates, convert between formats, and encrypt or decrypt files, but its subcommands and flags are notoriously easy to mistype.
This generator helps you build correct openssl commands without memorizing the syntax. You choose an operation from a dropdown, fill in the parameters that operation needs, and the tool assembles the exact command, explains what it does in plain language, and gives you a one-click copy button. Everything is produced locally in your browser — the tool only writes the command text, it never runs anything and never sends your inputs anywhere.
The available operations span the tasks people most often need: generating RSA, ECDSA, or algorithm-agnostic private keys; creating certificate signing requests with or without a new key; producing self-signed certificates; converting between PEM and PKCS12 and between PEM and DER; encrypting and decrypting files with a symmetric cipher; and inspecting certificates, CSRs, and keys. Certificate operations that need a subject can be filled in field by field.
Because the output is a plain command, you run it yourself on your own machine, where OpenSSL is installed. The generated commands use the same subcommands that have been stable in OpenSSL for years, so the result works on Linux and macOS, and on Windows through WSL or a native OpenSSL build. Treat the generator as a syntax helper and a learning aid: it removes the guesswork from flags so you can focus on getting the certificate or key you actually need.
Key Concepts
- Private key — the secret material used to sign and decrypt, generated by
genrsa,ecparamorgenpkey. - CSR — a certificate signing request that carries your subject details to a certificate authority.
- Self-signed certificate — a certificate signed by its own key, useful for testing and internal use.
- PEM and DER — two encodings of the same data: PEM is Base64 text, DER is binary.
- PKCS12 — a single password-protected container bundling a certificate and its key.
- Subject fields — the C, ST, L, O, OU and CN values that identify the certificate holder.
How to Use
- Choose an operation — Pick the task you want from the Operation dropdown, such as generating a key or a CSR.
- Fill in the parameters — The form shows only the fields that operation needs, such as key size, curve, file names or subject details.
- Generate the command — Click Generate Command to assemble the
opensslcommand from your inputs. - Read the description — The tool explains what the command does and what each flag means so you understand it before running it.
- Copy and run locally — Copy the command and run it in your own terminal where OpenSSL is installed.
Operations Reference
| Operation | What it does | Core command |
|---|---|---|
| Generate RSA Private Key | Creates an RSA private key of a chosen size. | openssl genrsa |
| Generate ECDSA Private Key | Creates an EC key on a named curve. | openssl ecparam -genkey |
| Generate Private Key (algorithm-agnostic) | Creates a key with a selected algorithm. | openssl genpkey |
| Generate CSR from Private Key | Builds a CSR from an existing key. | openssl req -new |
| Generate CSR + New Private Key | Creates a fresh key and a CSR together. | openssl req -new -newkey ... -nodes |
| Generate Self-Signed Certificate | Signs a certificate with an existing key. | openssl req -x509 |
| Generate Self-Signed Cert + New Key | Creates a key and a self-signed certificate. | openssl req -x509 -newkey ... -nodes |
| Convert PEM to PKCS12 | Bundles a certificate and key into a .p12 file. | openssl pkcs12 -export |
| Convert PKCS12 to PEM | Extracts PEM material from a .p12 file. | openssl pkcs12 -in ... -nodes |
| Encrypt File with Password | Encrypts a file with a symmetric cipher. | openssl enc -cipher -salt |
| Decrypt File with Password | Decrypts a previously encrypted file. | openssl enc -d |
| Convert PEM to DER | Re-encodes a PEM certificate as binary DER. | openssl x509 -outform DER |
| Convert DER to PEM | Re-encodes a DER certificate as PEM text. | openssl x509 -inform DER |
| View Certificate Details | Prints a certificate's decoded fields. | openssl x509 -text -noout |
| View CSR Details | Prints a CSR's decoded fields. | openssl req -text -noout |
| View Private Key Details | Prints a key's parameters. | openssl pkey -text -noout |
Certificate Subject Fields
| Field | Meaning | Example |
|---|---|---|
| C | Country | US |
| ST | State or province | California |
| L | Locality or city | San Francisco |
| O | Organization | Example Inc |
| OU | Organizational unit | IT Department |
| CN | Common name, usually the domain | example.com |
Worked Examples
- RSA key — a 2048-bit key is generated with
openssl genrsa -out private.key 2048. - ECDSA key — an EC key on the prime256v1 curve comes from
openssl ecparam -name prime256v1 -genkey -noout -out ec.key. - CSR with new key —
openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out csr.pem -subj "/CN=example.com"creates both the key and the request. - Self-signed certificate —
openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=localhost"makes a test certificate. - Bundle to PKCS12 —
openssl pkcs12 -export -out bundle.p12 -inkey key.pem -in cert.pempackages the pair into one file. - Inspect a certificate —
openssl x509 -in cert.pem -text -nooutprints every decoded field without saving anything.
Tips and Common Mistakes
- Know what
-nodesmeans — it stands for "no DES" and means the private key is written without a passphrase, which is convenient for servers but less safe on disk. - Use
-subjfor non-interactive runs — supplying subject details inline stops OpenSSL from prompting, which matters in scripts and CI. - Keep private keys private — set restrictive file permissions and never commit a key or PKCS12 bundle to a repository.
- Do not confuse -inform with -outform —
-informdescribes the input encoding, while-outformdescribes the output encoding. - Use -noout when inspecting — the detail commands print readable text but skip the Base64 body, keeping output short.
- This tool does not run commands — it only writes them. Nothing is executed or uploaded; you run the result yourself.
Common Use Cases
OpenSSL commands come up throughout development, operations and security work. These are the situations where the generator saves the most time.
- Local HTTPS testing — create a self-signed certificate and key to run a development server over TLS.
- Requesting certificates — build a CSR to send to a certificate authority for a public TLS certificate.
- Format conversion — move certificates and keys between PEM, DER and PKCS12 as different tools demand.
- File encryption — encrypt backups or secrets with a symmetric cipher and password.
- Troubleshooting TLS — inspect a certificate, CSR or key to confirm its subject, dates and parameters.
- Learning cryptography — explore how keys, requests and certificates are created without memorizing every flag.
Frequently Asked Questions
Do I need OpenSSL installed?
Yes. This tool generates OpenSSL commands for you to run on your own machine, so OpenSSL must be installed there. Most Linux and macOS systems include it, and Windows users can use WSL or a native build.
What does each output parameter mean?
-out sets the output file, -keyout sets where the private key is saved, -newkey generates a new key, -nodes means no passphrase on that key, and -subj supplies certificate subject details inline.
Is this tool secure?
Yes. It runs entirely in your browser and sends no data to any server. It only builds the command text; you run the command yourself on your own machine.
Does the tool run the commands for me?
No. It only writes the command and describes it. Copy the result and run it in your own terminal where OpenSSL is available.
What is the difference between PEM and DER?
PEM is a Base64 text encoding wrapped in BEGIN and END lines, while DER is the raw binary encoding. They can hold the same data and are converted with -inform and -outform.
What is PKCS12 used for?
PKCS12 is a single password-protected container that bundles a certificate together with its private key, which is convenient for importing into browsers and operating system stores.
What are the C, ST, L, O, OU and CN fields?
They are certificate subject fields: Country, State or province, Locality, Organization, Organizational Unit, and Common Name, which is usually the domain name.
Which key algorithms can I generate?
The generator can build commands for RSA keys with genrsa, ECDSA keys with ecparam, and algorithm-agnostic keys with genpkey, letting you pick the algorithm that fits your needs.