SSL/TLS Certificates & CSRs Cheat Sheet
Quick reference for SSL/TLS certificates: CSR generation, certificate types, chain files, validation, and openssl workflows.
Security Tools
ssl
tls
certificates
TLS secures connections using a public/private key pair and a certificate that binds the public key to a domain. The certificate is issued by a Certificate Authority (CA) after you submit a Certificate Signing Request (CSR).
Generate Key + CSR
bash
# 1. Securely generate a private key (2048-bit RSA)
openssl genrsa -out private.key 2048
chmod 600 private.key
# 2. Create the CSR (Subject = the entity being certified)
openssl req -new -key private.key -out server.csr \
-subj "/C=US/ST=California/L=San Francisco/O=Example Inc/CN=api.example.com"
# Modern ECDSA alternative
openssl ecparam -genkey -name prime256v1 -out ec.key
openssl req -new -key ec.key -out server.csr -subj "/CN=api.example.com"
Table
| CSR field | Meaning | Example |
|---|---|---|
C | Country (2-letter) | US |
ST | State/Province | California |
L | Locality | San Francisco |
O | Organization | Example Inc |
OU | Organizational unit | IT |
CN | Common name (the domain) | api.example.com |
SAN | Subject Alternative Names | DNS:api.example.com |
Inspecting a CSR
bash
openssl req -in server.csr -noout -text
openssl req -in server.csr -noout -subject
Certificate Chain & Validation
A TLS server must present the leaf certificate plus intermediate CAs (not the root). The chain order matters: leaf first, then intermediates.
bash
# View a certificate
openssl x509 -in cert.pem -noout -text
openssl x509 -in cert.pem -noout -subject -issuer -dates
# Verify the chain against the CA bundle
openssl verify -CAfile ca-bundle.crt -untrusted intermediate.crt cert.pem
# Check the live server's chain
openssl s_client -connect api.example.com:443 -servername api.example.com </dev/null
Common Formats
Table
| Format | Content | Extension |
|---|---|---|
| PEM | Base64 with -----BEGIN/END fences | .pem, .crt, .key |
| DER | Binary ASN.1 | .der |
| PKCS#12 | Key + certs in one password-protected file | .p12, .pfx |
bash
# Convert PEM → PKCS#12 (for servers/load balancers)
openssl pkcs12 -export -out bundle.p12 -inkey private.key -in cert.pem -certfile ca-bundle.crt
# Convert PKCS#12 → PEM
openssl pkcs12 -in bundle.p12 -nodes -out bundle.pem
Troubleshooting Checklist
Table
| Symptom | Likely cause | Check |
|---|---|---|
| "Certificate not trusted" | Missing intermediate in chain | Verify with -untrusted or look at the chain order |
| "Hostname mismatch" | CN/SAN doesn't match the URL | openssl x509 -noout -subject -ext subjectAltName |
| "Expired certificate" | Not renewed | -dates on the leaf cert |
| Handshake fails on some browsers | Key/cert mismatch | openssl x509 -noout -pubkey vs openssl pkey -pubout |
| Full chain rejected | Extra root included | Serve leaf + intermediates only |
Common Pitfalls
[!WARNING] Never commit the private key to a repository. Keep
private.keywith mode600and out of the web root; the public certificate is safe to share.
[!TIP] Use
openssl s_client -showcertsto dump the exact chain the server serves — the fastest way to see a missing or misordered intermediate.