| Task | Tool | Command | Use Case |
|---|---|---|---|
| View Certificate | OpenSSL | openssl x509 -in cert.crt -text -noout |
Inspect certificate details |
| Verify Chain | OpenSSL | openssl verify -CAfile chain.pem certificate.crt |
Validate trust chain |
| Check OCSP | OpenSSL | openssl ocsp -issuer issuer.crt -cert certificate.crt -url http://ocsp.example.com -CAfile chain.pem |
Check revocation status |
| PEM → DER | OpenSSL | openssl x509 -outform der -in certificate.pem -out certificate.der |
Convert format |
| DER → PEM | OpenSSL | openssl x509 -inform der -in certificate.der -out certificate.pem |
Convert format |
| PFX → PEM | OpenSSL | openssl pkcs12 -in certificate.pfx -out bundle.pem -nodes |
Extract certs and key |
| Extract Public Key | OpenSSL | openssl x509 -in certificate.crt -pubkey -noout > publicKey.pem |
Save public key from cert |
| List Keystore | Keytool | keytool -list -v -keystore keystore.jks |
Inspect keystore entries |
| JKS → PKCS#12 | Keytool | keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.p12 -deststoretype PKCS12 |
Convert Java keystore |
Essential OpenSSL commands for viewing, verifying, converting and comparing certificates and keys. Click any code box to copy.
openssl x509 -in certificate.crt -text -nooutopenssl x509 -outform der -in certificate.pem -out certificate.deropenssl x509 -inform der -in certificate.cer -out certificate.pemopenssl pkcs7 -print_certs -in certificate.p7b -out certificate.ceropenssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.ceropenssl pkcs12 -in certificate.pfx -out certificate.cer -nodesopenssl verify -CAfile chain.pem certificate.crtCertificate chain verification confirms that your leaf certificate is issued by a trusted CA through a valid sequence of signatures (leaf → intermediate(s) → root). The command above checks signatures, basic constraints, and key usage using the certificates provided in chain.pem. Include the issuing intermediate(s) and, if OpenSSL does not use your OS trust store, the root CA as well. A successful run prints certificate.crt: OK. Common errors include unable to get local issuer certificate (missing intermediate), self signed certificate (wrong chain), or unable to verify the first certificate (no trusted root supplied).
-CAfile. For complex chains, -untrusted can provide intermediates while -CAfile holds trusted roots.certificate.crt: OKopenssl ocsp -issuer issuer.crt -cert certificate.crt -url http://ocsp.example.com -CAfile chain.pemOCSP (Online Certificate Status Protocol) returns the current revocation status of a certificate from the CA’s responder. The OCSP URL comes from the certificate’s AIA extension. Pass the -issuer certificate that signed the leaf, the leaf certificate via -cert, and a trusted chain via -CAfile to validate the responder’s reply. Interpreting results: good means not revoked; revoked includes time and reason; unknown indicates the responder has no record. Check the This Update and Next Update timestamps to ensure freshness. OCSP is often stapled by servers during TLS; this command lets you query directly.
-CAfile contains the CA chain that signs the OCSP response. Avoid disabling verification flags unless troubleshooting.Response verify OK
certificate.crt: good
This Update: Dec 09 12:00:00 2025 GMT
Next Update: Dec 09 18:00:00 2025 GMTbash -c 'K=key.pem; C=cert.pem; KF=$(openssl pkey -in "$K" -pubout -outform DER | openssl sha256 | awk "{print $2}"); CF=$(openssl x509 -in "$C" -pubkey -noout | openssl pkey -pubin -outform DER | openssl sha256 | awk "{print $2}"); if [ "$KF" = "$CF" ]; then echo MATCH: $KF; else echo MISMATCH; echo Key: $KF; echo Cert: $CF; fi'$K='key.pem'; $C='cert.pem'; $KF = (openssl pkey -in $K -pubout -outform DER | openssl sha256) -replace '.*= ', ''; $CF = (openssl x509 -in $C -pubkey -noout | openssl pkey -pubin -outform DER | openssl sha256) -replace '.*= ', ''; if ($KF -eq $CF) { Write-Output ('MATCH: ' + $KF) } else { Write-Output 'MISMATCH'; Write-Output ('Key: ' + $KF); Write-Output ('Cert: ' + $CF) }Overview of common certificate and keystore formats with identification tips and conversion examples.
PEM is a Base64‑encoded ASCII format used widely by web servers. Files often end in .pem, .crt, .cer, or .key and include header/footer lines such as "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----". Server certificates, intermediates, and private keys can all be represented in PEM. Most platforms expect certificate, chain, and key in separate files even though multiple PEM blocks can appear in one file.
openssl x509 -in certificate.pem -text -nooutawk '/BEGIN CERT/{f="cert_"++i".cer"} {print >f}' bundle.pemDER is a binary encoding of certificate or key material. Files commonly use .der or .cer; a .cer may be PEM or DER, so BEGIN/END headers indicate PEM. Java platforms commonly use DER.
openssl x509 -inform der -in certificate.der -out certificate.pemopenssl x509 -outform der -in certificate.pem -out certificate.derPKCS#7 (P7B) bundles certificates and chain certificates, but not private keys. Typically ASCII Base64 with headers like "-----BEGIN PKCS7-----" and extensions .p7b or .p7c. Supported by Windows and Java app servers.
openssl pkcs7 -print_certs -in certificate.p7b -out certificates.pemPKCS#12 (PFX) is a binary, encryptable container that can store a private key, the server certificate, and intermediates together. Common extensions are .pfx and .p12; frequently used on Windows for import/export.
openssl pkcs12 -in certificate.pfx -nocerts -nodes -out privateKey.keyopenssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.ceropenssl pkcs12 -export -in certificate.cer -inkey privateKey.key -certfile CACert.cer -out certificate.pfx| Format | Contains Private Key? | Typical Extensions | Headers | Common Use |
|---|---|---|---|---|
| PEM | Yes (in .key) | .pem, .crt, .cer, .key | BEGIN/END blocks | Apache/Nginx, general web |
| DER | No (cert only) | .der, .cer | None (binary) | Java, Windows cert stores |
| PKCS#7/P7B | No | .p7b, .p7c | BEGIN/END PKCS7 | Windows, Tomcat |
| PKCS#12/PFX | Yes | .pfx, .p12 | None (binary container) | Windows import/export |
Common Java Keytool operations for generating keys, creating CSRs, importing CA replies, converting keystores, and inspecting entries. Click any code box to copy.
keytool -genkeypair -alias server -keyalg RSA -keysize 2048 -keystore keystore.jks -storepass changeit -keypass changeit -dname "CN=example.com, O=Example, OU=IT, L=City, ST=State, C=US"keytool -certreq -alias server -file request.csr -keystore keystore.jks -storepass changeit -ext SAN=dns:example.com,dns:www.example.comkeytool -importcert -alias server -file certificate.crt -keystore keystore.jks -storepass changeitkeytool -importcert -alias intermediate -file intermediate.crt -keystore keystore.jks -storepass changeitkeytool -list -v -alias server -keystore keystore.jks -storepass changeitkeytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.p12 -deststoretype PKCS12keytool -importkeystore -srckeystore keystore.p12 -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKSkeytool -list -v -keystore keystore.jkskeytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.pfx -deststoretype PKCS12 -storepass changeit -deststorepass changeitopenssl pkcs12 -in keystore.pfx -nocerts -nodes -out private.keyopenssl pkcs12 -in keystore.pfx -clcerts -nokeys -out certificate.crtopenssl x509 -outform der -in certificate.crt -out certificate.derGenerate public key, chain verification, and OCSP commands based on uploaded inputs. All generation occurs locally in your browser.
Step‑by‑step guidance to generate a keystore, create a CSR with SANs, import the issued certificate and CA chain, convert the keystore to PKCS#12, and optionally extract with OpenSSL. Fields below auto‑update the commands shown in each step.
Interactive diagrams to understand certificate chains and common CA hierarchies. Toggle tabs to view different chain layouts.