TLS and certificates

# The chain as sent, with the verification result at the end
openssl s_client -connect api.example.com:443 -servername api.example.com -showcerts </dev/null

# Leaf subject, issuer, dates and SANs
openssl s_client -connect api.example.com:443 -servername api.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

Verify return code: 0 (ok)

openssl x509 -in cert.pem -noout -text                                        # everything
openssl x509 -in cert.pem -noout -subject -issuer -dates
openssl x509 -in cert.pem -noout -ext subjectAltName,keyUsage,extendedKeyUsage,basicConstraints
openssl x509 -in cert.pem -noout -fingerprint -sha256
openssl x509 -in cert.pem -noout -checkend 604800                             # exit 1 if it expires within 7 days
openssl crl2pkcs7 -nocrl -certfile chain.pem | openssl pkcs7 -print_certs -noout   # subject and issuer of each cert in a bundle

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out key.pem   # widely supported, small, fast
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out key.pem      # maximum compatibility
openssl genpkey -algorithm ed25519 -out key.pem                                 # fine for private use; public CAs generally do not issue Ed25519 server certificates
chmod 600 key.pem

openssl req -new -key key.pem -out req.csr -config san.cnf
openssl req -in req.csr -noout -text -verify                                    # confirm SANs before sending

# san.cnf: the SAN list is what clients check
[req]
distinguished_name = dn
req_extensions     = v3_req
prompt             = no

[dn]
CN = api.example.com
O  = Example Pty Ltd
C  = AU

[v3_req]
keyUsage         = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName   = @alt

[alt]
DNS.1 = api.example.com
DNS.2 = api.internal.example.com
IP.1  = 192.0.2.10

diff <(openssl pkey -in key.pem -pubout) <(openssl x509 -in cert.pem -noout -pubkey) && echo match

# Root CA: long-lived, key kept offline
openssl req -x509 -new -newkey rsa:4096 -noenc -days 3650 -keyout ca.key -out ca.pem \
  -subj '/CN=Example Internal Root CA/O=Example Pty Ltd/C=AU' \
  -addext 'basicConstraints=critical,CA:TRUE,pathlen:1' \
  -addext 'keyUsage=critical,keyCertSign,cRLSign'

# Issue a leaf from a CSR, applying the extensions from san.cnf
openssl x509 -req -in req.csr -CA ca.pem -CAkey ca.key -CAcreateserial -days 90 \
  -extfile san.cnf -extensions v3_req -out cert.pem

openssl verify -CAfile ca.pem cert.pem

cert.pem: OK

cat cert.pem intermediate.pem > fullchain.pem

openssl x509 -in cert.der -inform der -out cert.pem                    # DER to PEM
openssl x509 -in cert.pem -outform der -out cert.der                   # PEM to DER
openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile chain.pem -out bundle.p12
openssl pkcs12 -export -legacy -in cert.pem -inkey key.pem -out old.p12  # 3DES/RC2 for old Java or Windows that cannot read the AES default
openssl pkcs12 -in bundle.p12 -noenc -out all.pem                      # everything, key unencrypted
openssl rsa -in key.pem -traditional -out key.pkcs1.pem                # PKCS#8 to PKCS#1 for old software
keytool -importkeystore -srckeystore bundle.p12 -srcstoretype PKCS12 -destkeystore store.jks -deststoretype JKS

openssl s_client -connect host.example.com:443 -servername host.example.com </dev/null                 # handshake detail and verify result
openssl s_client -connect host.example.com:443 -tls1_2 </dev/null                                      # force TLS 1.2
openssl s_client -connect host.example.com:443 -tls1_2 -cipher 'ECDHE-RSA-AES128-GCM-SHA256' </dev/null  # one TLS 1.2 suite
openssl s_client -connect host.example.com:443 -cert client.pem -key client.key </dev/null             # mTLS
openssl s_client -connect host.example.com:443 -status </dev/null | grep -A5 'OCSP'                    # stapled OCSP response, if any
openssl s_client -connect host.example.com:25 -starttls smtp </dev/null                                # STARTTLS
openssl s_time -connect host.example.com:443 -new -time 10                                             # full handshakes per second
nmap --script ssl-enum-ciphers -p 443 host.example.com                                                 # every protocol and suite the server accepts

openssl ciphers -v 'ECDHE+AESGCM:ECDHE+CHACHA20'           # expand a cipher string into the TLS 1.2 suites it selects
openssl ciphers -v -s -tls1_3                               # -s: only suites usable with the current security level and protocol
openssl ciphers -v 'DEFAULT:@SECLEVEL=2' | wc -l
openssl ciphers -stdname -v 'ECDHE-RSA-AES128-GCM-SHA256'  # IANA name alongside the OpenSSL name
openssl list -tls-groups                                    # key exchange groups this build supports (OpenSSL 3.5+)
openssl list -signature-algorithms

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;   # X25519MLKEM768 needs OpenSSL 3.5+
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
ssl_session_timeout 1d;
add_header Strict-Transport-Security "max-age=63072000" always;

# Issue a client certificate from the private CA: clientAuth EKU, no serverAuth
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -noenc -keyout client.key -out client.csr -subj '/CN=deploy-bot/O=Example Pty Ltd'
openssl x509 -req -in client.csr -CA ca.pem -CAkey ca.key -CAcreateserial -days 90 -out client.pem \
  -extfile <(printf 'keyUsage=critical,digitalSignature\nextendedKeyUsage=clientAuth\nsubjectAltName=URI:spiffe://example.com/ns/my-namespace/sa/my-app')

# Which CAs the server will accept client certificates from
openssl s_client -connect api.example.com:8443 -servername api.example.com </dev/null 2>/dev/null | sed -n '/Acceptable client certificate CA names/,/---/p'

# Test as the client; -verify_return_error makes s_client exit non-zero instead of continuing
openssl s_client -connect api.example.com:8443 -servername api.example.com -cert client.pem -key client.key -CAfile ca.pem -verify_return_error </dev/null
curl --cert client.pem --key client.key --cacert ca.pem https://api.example.com:8443/whoami

ssl_client_certificate /etc/nginx/client-ca.pem;    # CA bundle for client certificates; also decides the names advertised in CertificateRequest
ssl_verify_client on;                                # optional or optional_no_ca to let the application decide
ssl_verify_depth 2;
proxy_set_header X-Client-DN $ssl_client_s_dn;       # $ssl_client_verify is SUCCESS, FAILED:reason or NONE

certbot certonly --webroot -w /var/www/html -d www.example.com -d example.com -m ops@example.com --agree-tos --key-type ecdsa
certbot certonly --standalone --preferred-challenges http -d api.example.com     # needs port 80 free; stop the web server or use --pre-hook/--post-hook
certbot certonly --dns-cloudflare --dns-cloudflare-credentials /root/.secrets/cloudflare.ini -d '*.example.com' -d example.com
certbot --nginx -d www.example.com                                                # obtains and edits the nginx server block
certbot certonly --server https://acme-staging-v02.api.letsencrypt.org/directory --dry-run -d test.example.com

certbot certificates                       # every managed lineage, expiry and paths
certbot renew --dry-run                    # test every renewal against staging
certbot renew --deploy-hook 'systemctl reload nginx'   # runs only for lineages that actually renewed
certbot revoke --cert-name www.example.com --reason keycompromise
certbot delete --cert-name old.example.com
systemctl list-timers 'certbot*' 'snap.certbot*'      # renewal timer, twice daily; certbot only renews when under 30 days remain

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ops@example.com
    privateKeySecretRef:
      name: letsencrypt-account-key      # ACME account key, created by cert-manager
    solvers:
      - http01:
          ingress:
            ingressClassName: nginx     # a temporary Ingress serves the token
      - dns01:
          route53:
            region: ap-southeast-2       # credentials via IRSA or accessKeyID/secretAccessKeySecretRef
        selector:
          dnsZones: [example.com]        # use dns01 for these names; needed for wildcards
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: my-app
  namespace: my-namespace
spec:
  secretName: my-app-tls
  dnsNames: [my-app.example.com]
  duration: 2160h                        # 90d; ignored by Let's Encrypt, which sets its own
  renewBefore: 720h                      # 30d
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer

kubectl get certificate -A                                  # READY False means look further down the chain
kubectl describe certificate my-app -n my-namespace         # Events say which CertificateRequest it is waiting on
kubectl get certificaterequest,order,challenge -n my-namespace
kubectl describe challenge -n my-namespace                  # the reason the CA could not validate: DNS not propagated, Ingress unreachable, CAA
cmctl status certificate my-app -n my-namespace             # the whole chain in one command
cmctl renew my-app -n my-namespace                          # force renewal now
kubectl get secret my-app-tls -n my-namespace -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -dates -ext subjectAltName

# Days until a live endpoint's certificate expires
end=$(openssl s_client -connect api.example.com:443 -servername api.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -enddate | cut -d= -f2)
echo $(( ( $(date -d "$end" +%s) - $(date +%s) ) / 86400 )) days

openssl x509 -in cert.pem -noout -checkend $(( 30 * 86400 )) || echo 'expires within 30 days'

# Every certificate the server sends, with days remaining
openssl s_client -connect api.example.com:443 -servername api.example.com -showcerts </dev/null 2>/dev/null \
  | awk '/BEGIN CERT/{c++} {print > "chain-" c ".pem"}'
for f in chain-*.pem; do printf '%s  %s\n' "$(openssl x509 -in "$f" -noout -enddate | cut -d= -f2)" "$(openssl x509 -in "$f" -noout -subject)"; done; rm -f chain-*.pem

# Revocation: OCSP if the certificate has a responder URL, otherwise the CRL distribution point
openssl x509 -in cert.pem -noout -ocsp_uri
openssl ocsp -issuer intermediate.pem -cert cert.pem -url "$(openssl x509 -in cert.pem -noout -ocsp_uri)" -resp_text -noverify | head
openssl x509 -in cert.pem -noout -ext crlDistributionPoints
curl -sS "$(openssl x509 -in cert.pem -noout -ext crlDistributionPoints | grep -o 'http[^ ]*')" | openssl crl -inform der -noout -text | head
openssl verify -crl_check -CAfile chain.pem -CRLfile crl.pem cert.pem   # offline: OK, or "certificate revoked"

# Expiry for a list of hosts
while read -r h; do d=$(openssl s_client -connect "$h:443" -servername "$h" </dev/null 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2); printf '%-35s %s\n' "$h" "$d"; done < hosts.txt

# Fail if a certificate expires within 30 days
openssl x509 -in cert.pem -noout -checkend 2592000 || echo 'renew now'

# SANs on a live certificate
openssl s_client -connect host.example.com:443 -servername host.example.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName

# Chain as served, subject and issuer only
openssl s_client -connect host.example.com:443 -servername host.example.com -showcerts </dev/null 2>/dev/null | awk '/BEGIN CERT/,/END CERT/' | openssl crl2pkcs7 -nocrl -certfile /dev/stdin | openssl pkcs7 -print_certs -noout

# Certificate stored in a Kubernetes TLS secret
kubectl get secret my-app-tls -n my-namespace -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -subject -dates

# Deployed certificate against the file on disk
diff <(openssl x509 -in cert.pem -noout -fingerprint -sha256) <(openssl s_client -connect host.example.com:443 -servername host.example.com </dev/null 2>/dev/null | openssl x509 -noout -fingerprint -sha256)

# Protocol versions a server accepts (local OpenSSL policy may block tls1 and tls1_1)
for p in tls1 tls1_1 tls1_2 tls1_3; do printf '%-8s ' "$p"; openssl s_client -connect host.example.com:443 -servername host.example.com -"$p" </dev/null >/dev/null 2>&1 && echo yes || echo no; done

# Throwaway certificate for local testing, in the current directory
openssl req -x509 -newkey ed25519 -noenc -days 30 -keyout localhost.key -out localhost.crt -subj '/CN=localhost' -addext 'subjectAltName=DNS:localhost,IP:127.0.0.1'

# Decode a certificate held as base64 DER in a variable
base64 -d <<< "$CERT_B64" | openssl x509 -inform der -noout -text

# Serial numbers of every certificate in a bundle
openssl storeutl -noout -text -certs bundle.pem | grep -E -A1 'Serial Number:|Subject:'

# Verify a chain and print the path that was built
openssl verify -show_chain -CAfile root.pem -untrusted intermediate.pem cert.pem

# Verify against the system store instead of a file (Fedora/RHEL and Debian paths)
openssl verify -CApath /etc/ssl/certs cert.pem

# Is this certificate a CA, and how deep may it issue
openssl x509 -in cert.pem -noout -ext basicConstraints

# Key type and size of a certificate's public key
openssl x509 -in cert.pem -noout -pubkey | openssl pkey -pubin -noout -text | head -1

# Hash of the public key, for HPKP-style pinning or to compare keys across renewals
openssl x509 -in cert.pem -noout -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64

# Which key exchange group and cipher the server negotiated with TLS 1.3
openssl s_client -connect host.example.com:443 -servername host.example.com </dev/null 2>/dev/null | grep -E 'Protocol|Cipher|group'

# Does the server support session resumption (look for "Reused, TLSv1.3" in the second connection)
openssl s_client -connect host.example.com:443 -servername host.example.com -sess_out sess.pem </dev/null >/dev/null 2>&1; openssl s_client -connect host.example.com:443 -servername host.example.com -sess_in sess.pem </dev/null 2>/dev/null | grep -E '^(New|Reused)'

# Test a server through an HTTP proxy
openssl s_client -proxy proxy.example.com:3128 -connect host.example.com:443 -servername host.example.com </dev/null

# Test TLS on a non-HTTP port with STARTTLS (smtp, pop3, imap, ldap, postgres, mysql, xmpp, ftp)
openssl s_client -connect db.example.com:5432 -starttls postgres </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

# Test a specific backend behind a load balancer while sending the right SNI and Host
curl -sv --resolve host.example.com:443:192.0.2.10 https://host.example.com/ -o /dev/null 2>&1 | grep -E 'subject|expire|issuer'

# Split a PEM bundle into one file per certificate
awk '/BEGIN CERT/{n++} {print > "cert-" n ".pem"}' bundle.pem

# Which certificate in a bundle is the root (issuer == subject)
for f in cert-*.pem; do [[ $(openssl x509 -in "$f" -noout -subject) == "$(openssl x509 -in "$f" -noout -issuer | sed 's/^issuer/subject/')" ]] && echo "$f is self-signed"; done

# Convert an OpenSSH public key to PEM for tooling that wants X.509-style keys
ssh-keygen -f ~/.ssh/id_ed25519.pub -e -m PKCS8

# Encrypt a private key at rest with a passphrase (prompts) and decrypt it again
openssl pkey -in key.pem -aes-256-cbc -out key.enc.pem; openssl pkey -in key.enc.pem -out key.pem

# Check a CSR's signature and print the requested SANs only
openssl req -in req.csr -noout -verify -ext subjectAltName

# Find every certificate file under /etc and print the ones expiring within 60 days
find /etc -name '*.pem' -o -name '*.crt' 2>/dev/null | while read -r f; do openssl x509 -in "$f" -noout -checkend $((60*86400)) >/dev/null 2>&1 || { openssl x509 -in "$f" -noout -subject >/dev/null 2>&1 && echo "$f"; }; done

# Local test server that speaks TLS and echoes the request, for testing clients and their trust stores
openssl s_server -accept 8443 -cert localhost.crt -key localhost.key -www

# Local test server that requires a client certificate from your CA
openssl s_server -accept 8443 -cert server.pem -key server.key -CAfile ca.pem -Verify 1 -www

# Compare the certificate two hosts serve (are both nodes behind the balancer deployed?)
diff <(openssl s_client -connect 192.0.2.10:443 -servername host.example.com </dev/null 2>/dev/null | openssl x509 -noout -serial) <(openssl s_client -connect 192.0.2.11:443 -servername host.example.com </dev/null 2>/dev/null | openssl x509 -noout -serial) && echo same

# Generate a CSR from an existing certificate, keeping subject and SANs, for renewal with a new key
openssl x509 -in cert.pem -x509toreq -signkey newkey.pem -out renew.csr -copy_extensions copyall

#!/usr/bin/env bash
# usage: tls-expiry.sh [-w DAYS] endpoints.txt   (one host or host:port per line; # comments allowed)
set -euo pipefail
warn=30
while getopts ':w:' o; do case $o in w) warn=$OPTARG ;; *) echo "usage: $0 [-w days] file" >&2; exit 2 ;; esac; done
shift $((OPTIND - 1))
file=${1:?endpoints file required}
tmp=$(mktemp -d); trap 'rm -rf -- "$tmp"' EXIT
now=$(date +%s); rc=0

while IFS= read -r ep; do
  [[ $ep =~ ^[[:space:]]*(#|$) ]] && continue
  host=${ep%%:*}; port=${ep##*:}; [[ $port == "$host" ]] && port=443
  if ! out=$(timeout 15 openssl s_client -connect "$host:$port" -servername "$host" -showcerts </dev/null 2>/dev/null); then
    printf 'FAIL %-40s connect failed\n' "$ep"; rc=1; continue
  fi
  verify=$(grep -o 'Verify return code: .*' <<< "$out" | tail -1)
  [[ $verify == 'Verify return code: 0 (ok)' ]] || { printf 'FAIL %-40s %s\n' "$ep" "$verify"; rc=1; }
  awk -v d="$tmp/" '/BEGIN CERT/{n++} /BEGIN CERT/,/END CERT/{print > d n ".pem"}' <<< "$out"
  for c in "$tmp"/*.pem; do
    end=$(openssl x509 -in "$c" -noout -enddate | cut -d= -f2)
    days=$(( ( $(date -d "$end" +%s) - now ) / 86400 ))
    subj=$(openssl x509 -in "$c" -noout -subject | sed 's/^subject=//')
    if (( days < warn )); then printf 'WARN %-40s %4d days  %s\n' "$ep" "$days" "$subj"; rc=1
    else printf 'ok   %-40s %4d days  %s\n' "$ep" "$days" "$subj"; fi
  done
  rm -f "$tmp"/*.pem
done < "$file"
exit "$rc"

#!/usr/bin/env bash
# usage: ca-issue.sh OUTDIR NAME [NAME...]   e.g. ca-issue.sh /etc/pki/my-app api.example.com 192.0.2.10
# expects CA_DIR (default ./ca) to contain ca.pem and ca.key (encrypted); writes OUTDIR/{key,cert,fullchain}.pem
set -euo pipefail
ca_dir=${CA_DIR:-./ca}; days=${DAYS:-90}
out=${1:?output directory required}; shift
(( $# )) || { echo 'at least one DNS name or IP required' >&2; exit 2; }
[[ -f $ca_dir/ca.pem && -f $ca_dir/ca.key ]] || { echo "no CA in $ca_dir" >&2; exit 1; }
umask 077; mkdir -p "$out"

san=''
for n in "$@"; do
  if [[ $n =~ ^[0-9]+(\.[0-9]+){3}$ || $n == *:*:* ]]; then san+="IP:$n,"; else san+="DNS:$n,"; fi
done
san=${san%,}
cn=$1

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out "$out/key.pem"
openssl req -new -key "$out/key.pem" -subj "/CN=$cn" -out "$out/req.csr"
openssl x509 -req -in "$out/req.csr" -CA "$ca_dir/ca.pem" -CAkey "$ca_dir/ca.key" \
  -CAserial "$ca_dir/serial" -CAcreateserial -days "$days" -out "$out/cert.pem" \
  -extfile <(printf 'basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature\nextendedKeyUsage=serverAuth\nsubjectAltName=%s\n' "$san")
cat "$out/cert.pem" "$ca_dir/ca.pem" > "$out/fullchain.pem"   # include the root only if clients need it; drop it for public-style chains
rm -f "$out/req.csr"
chmod 644 "$out/cert.pem" "$out/fullchain.pem"

openssl verify -CAfile "$ca_dir/ca.pem" "$out/cert.pem"
openssl x509 -in "$out/cert.pem" -noout -subject -enddate -ext subjectAltName

#!/usr/bin/env bash
# usage: tls-fleet-check.sh HOSTNAME fullchain.pem IP...   e.g. tls-fleet-check.sh api.example.com /etc/pki/api/fullchain.pem 192.0.2.10 192.0.2.11
set -euo pipefail
name=${1:?hostname}; file=${2:?certificate file}; shift 2
(( $# )) || { echo 'no backend IPs given' >&2; exit 2; }
want=$(openssl x509 -in "$file" -noout -fingerprint -sha256 | cut -d= -f2)
printf 'expected %s\n' "$want"
rc=0
for ip in "$@"; do
  got=$(timeout 10 openssl s_client -connect "$ip:443" -servername "$name" </dev/null 2>/dev/null | openssl x509 -noout -fingerprint -sha256 2>/dev/null | cut -d= -f2 || true)
  if [[ -z $got ]]; then printf 'FAIL %-16s no certificate (connect or handshake failed)\n' "$ip"; rc=1
  elif [[ $got == "$want" ]]; then printf 'ok   %-16s\n' "$ip"
  else printf 'DIFF %-16s %s\n' "$ip" "$got"; rc=1; fi
done
exit "$rc"