TLS and certificates

openssl s_client -connect api.example.com:443 -servername api.example.com -showcerts </dev/null
openssl s_client -connect api.example.com:443 -servername api.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

openssl x509 -in cert.pem -noout -text                      # everything
openssl x509 -in cert.pem -noout -subject -issuer -dates
openssl x509 -in cert.pem -noout -ext subjectAltName,keyUsage,extendedKeyUsage
openssl x509 -in cert.pem -noout -fingerprint -sha256
openssl x509 -in cert.pem -noout -checkend 604800           # expires within 7 days?
openssl crl2pkcs7 -nocrl -certfile chain.pem | openssl pkcs7 -print_certs -noout   # list a bundle

openssl genpkey -algorithm ed25519 -out key.pem                     # modern, small, fast
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out key.pem
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out key.pem
chmod 600 key.pem

openssl req -new -key key.pem -out req.csr -config san.cnf
openssl req -in req.csr -noout -text -verify                        # confirm before sending

# san.cnf — SANs are mandatory; CN alone is ignored
[req]
distinguished_name = dn
req_extensions     = v3_req
prompt             = no

[dn]
CN = api.example.com
O  = Example Pty Ltd
C  = AU

[v3_req]
keyUsage         = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName   = @alt

[alt]
DNS.1 = api.example.com
DNS.2 = api.internal.example.com
IP.1  = 10.0.0.5

diff <(openssl pkey -in key.pem -pubout) <(openssl x509 -in cert.pem -noout -pubkey) && echo match

# Root (offline, long-lived)
openssl req -x509 -new -newkey rsa:4096 -nodes -days 3650 -keyout ca.key -out ca.pem \
  -subj '/CN=Example Internal Root CA/O=Example Pty Ltd/C=AU' \
  -addext 'basicConstraints=critical,CA:TRUE,pathlen:1' -addext 'keyUsage=critical,keyCertSign,cRLSign'

# Issue a leaf from a CSR
openssl x509 -req -in req.csr -CA ca.pem -CAkey ca.key -CAcreateserial -days 90 \
  -extfile san.cnf -extensions v3_req -out cert.pem

openssl verify -CAfile ca.pem cert.pem
cat cert.pem intermediate.pem > fullchain.pem      # leaf first, root omitted

openssl x509 -in cert.der -inform der -out cert.pem              # DER -> PEM
openssl x509 -in cert.pem -outform der -out cert.der             # PEM -> DER
openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile ca.pem -out bundle.p12
openssl pkcs12 -in bundle.p12 -nodes -out all.pem                # extract everything
openssl rsa -in key.pem -out key.pkcs1.pem                       # PKCS#8 -> PKCS#1 for old software
keytool -importkeystore -srckeystore bundle.p12 -srcstoretype PKCS12 -destkeystore store.jks

openssl s_client -connect host:443 -servername host </dev/null                 # handshake detail
openssl s_client -connect host:443 -tls1_2 </dev/null                          # force a version
openssl s_client -connect host:443 -cipher 'ECDHE-RSA-AES128-GCM-SHA256' </dev/null
openssl s_client -connect host:443 -cert client.pem -key client.key </dev/null # mTLS
openssl s_client -connect host:443 -status </dev/null | grep -A5 'OCSP'        # stapling
openssl s_client -connect host:25 -starttls smtp </dev/null                    # opportunistic TLS
openssl s_time -connect host:443 -new -time 10                                 # handshakes per second
nmap --script ssl-enum-ciphers -p 443 host                                     # full policy view

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305;
ssl_session_timeout 1d;
ssl_stapling on;
add_header Strict-Transport-Security "max-age=63072000" always;

# Days remaining for a live endpoint
echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null \
  | openssl x509 -noout -enddate | cut -d= -f2 \
  | xargs -I{} sh -c 'echo $(( ( $(date -d "{}" +%s) - $(date +%s) ) / 86400 )) days'

# Expiry for a list of hosts
while read -r h; do d=$(echo | openssl s_client -connect "$h:443" -servername "$h" 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2); printf '%-35s %s\n' "$h" "$d"; done < hosts.txt

# Fail if a certificate expires within 30 days
openssl x509 -in cert.pem -noout -checkend 2592000 || echo 'renew now'

# Which SANs does a live certificate carry
echo | openssl s_client -connect host:443 -servername host 2>/dev/null | openssl x509 -noout -ext subjectAltName

# Chain as served, subject and issuer only
echo | openssl s_client -connect host:443 -showcerts 2>/dev/null | awk '/BEGIN CERT/,/END CERT/' | openssl crl2pkcs7 -nocrl -certfile /dev/stdin | openssl pkcs7 -print_certs -noout

# Verify a chain file offline
openssl verify -CAfile root.pem -untrusted intermediate.pem cert.pem

# Certificate from a Kubernetes secret
kubectl get secret tls-api -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -subject -dates

# Compare deployed certificate with the file on disk
diff <(openssl x509 -in cert.pem -noout -fingerprint -sha256) <(echo | openssl s_client -connect host:443 -servername host 2>/dev/null | openssl x509 -noout -fingerprint -sha256)

# Protocol versions a server accepts
for p in tls1 tls1_1 tls1_2 tls1_3; do printf '%-8s ' "$p"; echo | openssl s_client -connect host:443 -"$p" >/dev/null 2>&1 && echo yes || echo no; done

# Generate a throwaway certificate for local testing
openssl req -x509 -newkey ed25519 -nodes -days 30 -keyout /tmp/k.pem -out /tmp/c.pem -subj '/CN=localhost' -addext 'subjectAltName=DNS:localhost,IP:127.0.0.1'

# Decode a certificate pasted as base64
base64 -d <<< "$B64" | openssl x509 -noout -text

# Serial numbers of everything in a bundle
openssl crl2pkcs7 -nocrl -certfile bundle.pem | openssl pkcs7 -print_certs | grep -E 'subject|serial'