OpenSSL Guide
Overview
OpenSSL is a powerful, open-source cryptographic toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, providing a robust foundation for secure communications. This comprehensive guide covers both fundamental concepts and practical applications of OpenSSL for certificate management, encryption, and cryptographic operations.
With its versatile capabilities, OpenSSL enables security professionals, system administrators, and developers to:
- Create and manage digital certificates and certificate authorities (CAs)
- Configure secure server communications with strong encryption
- Generate and manage cryptographic keys of various types and strengths
- Test and validate SSL/TLS implementations for security vulnerabilities
- Convert certificates between different formats and standards
- Implement secure authentication mechanisms
- Encrypt sensitive data using industry-standard algorithms
- Develop security-focused applications with cryptographic functionality
OpenSSL is one of the most widely deployed security toolkits in the world, and forms a critical component in countless security-critical applications and infrastructure.
Note
This guide is designed to be practical and hands-on, with ready-to-use command examples and real-world scenarios. Commands are tested with OpenSSL 3.x, with notes for version-specific differences where relevant.
Start Here
In a hurry? The Quick Reference collects the commands needed most often on a single page.
Otherwise, find your task below:
| I want to… | Go to |
|---|---|
| Look up a command I half-remember | Quick Reference |
| Install OpenSSL, or check which version I have | Installation |
| Understand what every field in a certificate means | Anatomy of an X.509 Certificate |
| Understand certificates, chains, and how OpenSSL is put together | Basic Concepts |
| See what is inside a certificate I already have | Certificate Operations |
| Work out why a certificate is not trusted | Certificate Chain Verification |
| Create a self-signed certificate for testing | Certificate Operations |
| Request a certificate from a commercial CA | CSR Creation and Management |
| Cover several hostnames with one certificate | Subject Alternative Names |
| Run my own CA for internal services | Running a Private CA |
| Revoke a certificate I issued | Managing CRLs |
| Generate or protect a private key | Private Key Management |
Turn a .pfx into .pem, or the reverse |
Certificate Conversions |
| Check what a live server is serving | SSL/TLS Testing |
| Diagnose a failing TLS connection | Validation and Troubleshooting |
| Stop renewing certificates by hand | ACME (Automated Certificates) |
OpenSSL Versions
OpenSSL has evolved significantly over time with critical security improvements in each major release. Understanding version differences is essential when working across different environments, particularly for security-critical applications.
Version History
| Version | Released | Support Status (2026) | Key Features & Security Notes |
|---|---|---|---|
| 3.5.x | Apr 2025 | Supported (LTS) — through Apr 2030 | Current LTS. Post-quantum key exchange (ML-KEM), server-side QUIC, refined provider architecture |
| 3.4.x | Oct 2024 | Supported — through Oct 2026 | Incremental improvements over 3.3; standard (non-LTS) release |
| 3.3.x | Apr 2024 | End of Life (Apr 2026) | QUIC client improvements; upgrade to 3.4/3.5 |
| 3.2.x | Nov 2023 | End of Life (Nov 2025) | Expanded QUIC API, client-side QUIC, improved TLS implementation |
| 3.1.x | Mar 2023 | End of Life (Mar 2025) | Enhanced FIPS compliance, provider improvements |
| 3.0.x | Sep 2021 | Supported (LTS) — through Sep 2026 | First provider-based release; FIPS 140-2 validated module. Plan migration to 3.5 LTS |
| 1.1.1 | Sep 2018 | End of Life (Sep 2023) | Introduced TLS 1.3, ChaCha20-Poly1305; no longer receives public fixes |
| 1.0.2 and earlier | 2015 or earlier | Obsolete | Lacks modern features; contains known vulnerabilities (e.g. Heartbleed in 1.0.1) — do not use |
Critical Security Vulnerabilities by Version
| Version | Notable Vulnerabilities | Impact |
|---|---|---|
| 3.0.0-3.0.7 | CVE-2022-3786, CVE-2022-3602 (X.509 Email Address Buffer Overflows) | Remote code execution possible |
| 3.0.0-3.0.6 | CVE-2022-2274 (AES OCB mode) | Remote code execution via cryptographic operations |
| 1.0.1-1.0.1f | CVE-2014-0160 (Heartbleed) | Memory exposure including private keys |
| All versions before 1.1.1 | Various TLS downgrade attacks | Protocol version and cipher downgrades |
| 1.0.2-1.0.2a | CVE-2015-0291 | Denial of service via client certificate verification |
Version Verification
Always verify the OpenSSL version in your environment before executing commands, as syntax and capabilities may vary between versions:
# Display full version information
openssl version -a
# Check if your version supports a specific feature (e.g., TLS 1.3)
openssl ciphers -v | grep TLSv1.3
# List supported cipher suites
openssl ciphers -v 'ALL'
# Check supported elliptic curves
openssl ecparam -list_curves
Important
Security Alert: Using outdated OpenSSL versions poses significant security risks. Known vulnerabilities in older versions (like Heartbleed in 1.0.1) can be exploited to compromise cryptographic operations, leak sensitive data, or bypass security controls entirely. Always use OpenSSL 1.1.1 or later (preferably 3.x) in any production environment. If you're running a version older than 1.1.1, update immediately as a security priority.
In This Section
- Quick Reference — The commands needed most often, on one page
- Installation — Installing and verifying OpenSSL on Linux, Windows, macOS, and Docker
- Basic Concepts — Core PKI and cryptographic concepts, the anatomy of an X.509 certificate, OpenSSL architecture, and file naming conventions
- Certificate Operations — Creating, inspecting, and verifying X.509 certificates, including SANs and wildcards
- Running a Private CA — Building a two-tier CA (offline root plus issuing CA), signing certificates, and managing revocation
- Private Key Management — Generating, protecting, analyzing, and converting private keys with OpenSSL
- CSR Creation and Management — Creating and verifying Certificate Signing Requests (CSRs) with OpenSSL
- Certificate Conversions — Converting certificates and keys between PEM, DER, PKCS#7, PKCS#12, and JKS formats
- Validation and Troubleshooting — Verifying certificates, checking revocation, and diagnosing common OpenSSL issues
- SSL/TLS Testing — Testing SSL/TLS connections, ciphers, and TLS 1.3 with OpenSSL s_client and s_server
- Advanced Operations — Symmetric encryption, OCSP, timestamping, performance testing, HSMs, and ECC with OpenSSL
- Best Practices & Security — Certificate automation, known vulnerabilities, secure configuration, and best practices for OpenSSL