Check SSL Certificate with OpenSSL

Useful OpenSSL Commands for Checking SSL Certificates

OpenSSL is a powerful tool for managing and validating SSL certificates. Below are some essential commands for examining SSL certificates and ensuring proper configuration.

1. Checking SSL Certificate Details

To retrieve details about your SSL certificate, including issuer, expiration date, and subject information.

openssl x509 -in certificate.crt -text -noout

2. Checking a CSR (Certificate Signing Request)

Ensure your CSR is correctly formatted and verify its contents:

openssl req -text -noout -verify -in CSR.csr

3. Verifying a Private Key

Confirm that your private key is valid and correctly formatted:

openssl rsa -in privateKey.key -check

4. Checking SSL Certificate and Private Key Match

If you experience errors like “Private Key does not match the Certificate,” use the following commands to verify:

openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl rsa -noout -modulus -in privateKey.key | openssl md5
openssl req -noout -modulus -in CSR.csr | openssl md5

5. Testing an SSL Connection

To check if the SSL certificate is correctly installed and if all intermediate certificates are present:

openssl s_client -connect www.example.com:443

6. Converting SSL Certificate Formats

Convert a DER (.crt/.cer) certificate to PEM format:

openssl x509 -inform der -in certificate.cer -out certificate.pem

Convert a PEM certificate to a PKCS#12 (.pfx) file:

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt

Ensure your website’s SSL security by checking SSL certificates with OpenSSL. TrackSSL provides an easy-to-follow guide and powerful tools to help you verify certificate validity, diagnose errors, and debug TLS/SSL configurations.