OpenSSL Command Builder

How to use OpenSSL Command Builder

Choose a certificate task and fill in the table. CSR fields include the common name, country, state, locality, organization, domain SANs, IP SANs and email. Conversion tasks ask only for local filenames. Generate and copy the command, then run it with OpenSSL 3.x in Bash or sh on Linux, macOS or Windows WSL.

Understanding the results

This tool generates commands only. It does not create, upload or inspect your keys or certificates. Passwords are entered in your terminal. Choose new output filenames to avoid overwriting existing files.

Does creating a CSR give me a trusted certificate?

No. A CSR is a signing request. Send it to your certificate authority, which validates the request and issues a certificate. Keep the matching private key private.

What is the difference between CN and SAN?

CN is the subject common name. SAN lists the domains and IP addresses requested for the certificate. This builder automatically includes the main name in SAN and adds your additional names.

Does combining PEM files validate the CA chain?

No. Use the server certificate first, followed by the correct intermediate certificates in issuer order. Combining files neither downloads missing issuers nor verifies trust.

Can I enter my PFX or private-key password here?

No password field is provided. OpenSSL prompts for passwords on your computer. Private keys are encrypted by default when creating a CSR or extracting PEM.

Can I request security extensions in my CSR?

Yes. Select Server certificate, Client certificate or Custom under Security extensions. Configure Key Usage, Extended Key Usage, Basic Constraints (CA:FALSE) and critical flags. SAN-only remains the default. These are requests; the certificate authority determines the issued extensions.

Can I choose RSA or EC and the key size?

Yes. CSR creation supports RSA at 2048, 3072 or 4096 bits, or EC with P-256, P-384 or P-521. Choose a type supported by your CA and application. EC presets use Digital Signature and omit RSA Key Encipherment. RSA and EC bit lengths are not directly comparable.

How do I verify my files before installation?

Choose one of the verification tasks to inspect a CSR signature, match public keys across your certificate/key/CSR, verify a chain against a supplied trusted root, or check expiry and the intended hostname/IP. Commands run locally. A key match is not a trust check, and a chain check does not test the live server or revocation.