Openssl: For Windows

openssl version Example output:

openssl enc -d -aes-256-cbc -in secret.enc -out decrypted.txt | Problem | Solution | |---------|----------| | openssl is not recognized | Add C:\Program Files\OpenSSL-Win64\bin to PATH, restart cmd | | Can't open config file: openssl.cnf | Set OPENSSL_CONF env var: set OPENSSL_CONF=C:\Program Files\OpenSSL-Win64\bin\openssl.cfg | | unable to load config info | Create a minimal openssl.cnf or use -config flag | | no /dev/null in Windows | Use NUL instead: 2>NUL | | SSL connect hangs | Use -ign_eof or echo Q \| openssl s_client ... | 13. Environment Setup (Optional) Create a batch file openssl_env.bat : openssl for windows

openssl x509 -noout -modulus -in cert.pem | openssl md5 openssl rsa -noout -modulus -in private.key | openssl md5 The hashes must be identical. Connect to HTTPS server (show certificate chain) openssl s_client -connect google.com:443 Save server certificate to file openssl s_client -connect google.com:443 -showcerts </dev/null 2>nul | openssl x509 -out google.crt ( </dev/null 2>nul prevents hanging on Windows – use Git Bash or WSL for cleaner output) openssl version Example output: openssl enc -d -aes-256-cbc

OpenSSL 3.4.0 22 Oct 2024 (Library: OpenSSL 3.4.0 22 Oct 2024) | Task | Command | |------|---------| | Show help | openssl help | | List all commands | openssl list -commands | | Show ciphers | openssl ciphers -v | 4. Working with Private Keys Generate RSA private key (2048-bit) openssl genrsa -out private.key 2048 Generate with AES256 encryption (password protected) openssl genrsa -aes256 -out encrypted.key 2048 Extract public key openssl rsa -in private.key -pubout -out public.key View key details openssl rsa -in private.key -text -noout 5. Certificate Signing Requests (CSR) Generate CSR + new private key openssl req -new -newkey rsa:2048 -nodes -out request.csr -keyout private.key Generate CSR from existing private key openssl req -new -key private.key -out request.csr View CSR content openssl req -in request.csr -text -noout 6. Self-Signed Certificate Simple (single line, 365 days) openssl req -x509 -newkey rsa:2048 -nodes -keyout selfsigned.key -out selfsigned.crt -days 365 With specific subject (no interactive prompts) openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=localhost" 7. View Certificates Read PEM certificate openssl x509 -in cert.pem -text -noout Read DER certificate openssl x509 -in cert.der -inform DER -text -noout Get certificate expiry date openssl x509 -in cert.pem -enddate -noout 8. Convert Certificate Formats | From | To | Command | |------|----|---------| | PEM в†’ DER | Binary | openssl x509 -in cert.pem -outform DER -out cert.der | | DER в†’ PEM | Text base64 | openssl x509 -inform DER -in cert.der -outform PEM -out cert.pem | | PEM + key в†’ PKCS#12 (.pfx) | Archive | openssl pkcs12 -export -out archive.pfx -inkey private.key -in cert.pem | | PKCS#12 в†’ PEM | Extract | openssl pkcs12 -in archive.pfx -out extracted.pem -nodes | 9. Verify Certificate & Key Match Check if private key matches certificate: Connect to HTTPS server (show certificate chain) openssl

@echo off set OPENSSL_CONF=C:\Program Files\OpenSSL-Win64\bin\openssl.cfg set PATH=%PATH%;C:\Program Files\OpenSSL-Win64\bin echo OpenSSL ready Run before using OpenSSL:

Alternative for :