OpenSSL command line tool.
Syntax
openssl command [ command_opts ] [ command_args ]
openssl [ list-standard-commands | list-message-digest-commands | list-cipher-commands ]
openssl no-XXX [ arbitrary options ]
Standard Commands
asn1parse Parse an ASN.1 sequence.
ca Certificate Authority (CA) Management.
ciphers Cipher Suite Description Determination.
cms CMS (Cryptographic Message Syntax) command.
crl Certificate Revocation List (CRL) Management.
crl2pkcs7 CRL to PKCS#7 Conversion.
dgst Message Digest Calculation.
dhparam Generation and Management of Diffie-Hellman Parameters.
dh Diffie-Hellman Parameter Management. Obsoleted by dhparam.
dsa DSA Data Management.
dsaparam DSA Parameter Generation.
ec EC (Elliptic curve) key processing.
ecparam EC parameter manipulation and generation.
enc Encoding with Ciphers.
engine Engine (loadable module) information and manipulation.
errstr Error Number to Error String Conversion.
fipsinstall FIPS configuration installation.
gendsa Generation of DSA Parameters.
genpkey Generation of Private Key or Parameters.
genrsa Generation of RSA Parameters.
help Display information about a command's options.
info Display diverse information built into the OpenSSL libraries.
kdf Key Derivation Functions.
list List algorithms and features.
mac Message Authentication Code Calculation.
nseq Create or examine a Netscape certificate sequence.
ocsp Online Certificate Status Protocol utility.
passwd Generation of hashed passwords.
pkcs12 PKCS#12 Data Management.
pkcs7 PKCS#7 Data Management.
pkcs8 PKCS#8 format private key conversion command.
pkey Public and private key management.
pkeyparam Public key algorithm parameter management.
pkeyutl Public key algorithm cryptographic operation command.
prime Compute prime numbers.
rand [options] num
Generate pseudo-random bytes.
When converted to base64, an additional pad character "0" may be suffixed to
make the encoded output an integer multiple of 4 characters.
If the unencoded binary text is a multiple of 3 bytes (3,6,9,12,15,18...)
then no pad characters will be added to the output.
3 bytes> 4 characters, 6 bytes>8 characters etc.
rehash Create symbolic links to certificate and CRL files named by the hash values.
req X.509 Certificate Signing Request (CSR) Management.
rsa RSA Data Management.
rsautl RSA utility for signing, verification, encryption, and decryption.
s_client This implements a generic SSL/TLS client which can establish a transparent
connection to a remote server speaking SSL/TLS. It’s intended for testing
purposes only and provides only rudimentary interface functionality but
internally uses mostly all functionality of the OpenSSL ssl library.
s_server This implements a generic SSL/TLS server which accepts connections from
remote clients speaking SSL/TLS. It’s intended for testing purposes only and
provides only rudimentary interface functionality but internally uses mostly
all functionality of the OpenSSL ssl library. It provides both an own
command line oriented protocol for testing SSL functions and a simple HTTP
response facility to emulate an SSL/TLS-aware webserver.
s_time SSL Connection Timer.
sess_id SSL Session Data Management.
smime S/MIME mail processing.
speed Algorithm Speed Measurement.
spkac SPKAC printing and generating command.
srp Maintain SRP password file. This command is deprecated.
storeutl Command to list and display certificates, keys, CRLs, etc.
ts Time Stamping Authority command.
verify X.509 Certificate Verification.
version OpenSSL Version Information.
x509 X.509 Certificate Data Management.
MESSAGE DIGEST Commands
blake2b512 BLAKE2b-512 Digest
blake2s256 BLAKE2s-256 Digest
md2 MD2 Digest
md4 MD4 Digest
md5 MD5 Digest
mdc2 MDC2 Digest
rmd160 RMD-160 Digest
sha1 SHA-1 Digest
sha224 SHA-2 224 Digest
sha256 SHA-2 256 Digest
sha384 SHA-2 384 Digest
sha512 SHA-2 512 Digest
sha3-224 SHA-3 224 Digest
sha3-256 SHA-3 256 Digest
sha3-384 SHA-3 384 Digest
sha3-512 SHA-3 512 Digest
keccak-224 KECCAK 224 Digest
keccak-256 KECCAK 256 Digest
keccak-384 KECCAK 384 Digest
keccak-512 KECCAK 512 Digest
shake128 SHA-3 SHAKE128 Digest
shake256 SHA-3 SHAKE256 Digest
sm3 SM3 Digest
Encryption, Decryption, and Encoding Commands
The following aliases provide convenient access to the most used encodings and ciphers.
Depending on how OpenSSL was configured and built, not all ciphers listed here may be present. See openssl-enc(1) for more.
aes128, aes-128-cbc, aes-128-cfb, aes-128-ctr, aes-128-ecb, aes-128-ofb
AES-128 Cipher
aes192, aes-192-cbc, aes-192-cfb, aes-192-ctr, aes-192-ecb, aes-192-ofb
AES-192 Cipher
aes256, aes-256-cbc, aes-256-cfb, aes-256-ctr, aes-256-ecb, aes-256-ofb
AES-256 Cipher
aria128, aria-128-cbc, aria-128-cfb, aria-128-ctr, aria-128-ecb, aria-128-ofb
Aria-128 Cipher
aria192, aria-192-cbc, aria-192-cfb, aria-192-ctr, aria-192-ecb, aria-192-ofb
Aria-192 Cipher
aria256, aria-256-cbc, aria-256-cfb, aria-256-ctr, aria-256-ecb, aria-256-ofb
Aria-256 Cipher
base64
Base64 Encoding
bf, bf-cbc, bf-cfb, bf-ecb, bf-ofb
Blowfish Cipher
camellia128, camellia-128-cbc, camellia-128-cfb, camellia-128-ctr, camellia-128-ecb, camellia-128-ofb
Camellia-128 Cipher
camellia192, camellia-192-cbc, camellia-192-cfb, camellia-192-ctr, camellia-192-ecb, camellia-192-ofb
Camellia-192 Cipher
camellia256, camellia-256-cbc, camellia-256-cfb, camellia-256-ctr, camellia-256-ecb, camellia-256-ofb
Camellia-256 Cipher
cast, cast-cbc
CAST Cipher
cast5-cbc, cast5-cfb, cast5-ecb, cast5-ofb
CAST5 Cipher
chacha20
Chacha20 Cipher
des, des-cbc, des-cfb, des-ecb, des-ede, des-ede-cbc, des-ede-cfb, des-ede-ofb, des-ofb
DES Cipher
des3, desx, des-ede3, des-ede3-cbc, des-ede3-cfb, des-ede3-ofb
Triple-DES Cipher
idea, idea-cbc, idea-cfb, idea-ecb, idea-ofb
IDEA Cipher
rc2, rc2-cbc, rc2-cfb, rc2-ecb, rc2-ofb
RC2 Cipher
rc4 RC4 Cipher
rc5, rc5-cbc, rc5-cfb, rc5-ecb, rc5-ofb
RC5 Cipher
seed, seed-cbc, seed-cfb, seed-ecb, seed-ofb
SEED Cipher
sm4, sm4-cbc, sm4-cfb, sm4-ctr, sm4-ecb, sm4-ofb
SM4 Cipher
PASS PHRASE Arguments
Several commands accept password arguments, typically using -passin and -passout for input and output passwords respectively. These allow the password to be obtained from a variety of sources. Both of these options take a single argument whose format is described below. If no password argument is given and a password is required then the user is prompted to enter one: this will typically be read from the current terminal with echoing turned off.
pass:password
the actual password is password. Since the password is visible to utilities
(like 'ps' under Unix) this form should only be used where security is not
important.
env:var obtain the password from the environment variable var. Since the environment
of other processes is visible on certain platforms (e.g. ps under certain
Unix OSes) this option should be used with caution.
file:pathname
the first line of pathname is the password. If the same pathname argument is
supplied to -passin and -passout arguments then the first line will be used
for the input password and the next line for the output password. pathname
need not refer to a regular file: it could for example refer to a device or
named pipe.
fd:number read the password from the file descriptor number. This can be used to send
the data via a pipe for example.
stdin read the password from standard input.
OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) network protocols and related cryptography standards required by them.
The openssl program is a command line tool for using the various cryptography functions of OpenSSL’s crypto library from the shell. It can be used for
The openssl program provides a rich variety of commands (command in the SYNOPSIS above), each of which often has a wealth of options and arguments (command_opts and command_args in the SYNOPSIS).
The pseudo-commands list-standard-commands, list-message-digest-commands, and list- cipher-commands output a list (one entry per line) of the names of all standard commands, message digest commands, or cipher commands, respectively, that are available in the present openssl utility.
-help Provides a terse summary of all options. For more detailed information, each command supports a -help option.
-version Provides a terse summary of the openssl program version. For more detailed information see openssl-version(1).
-engine id Load the engine identified by id and use all the methods it implements (algorithms, key storage, etc.), unless specified otherwise in the command-specific documentation or it is configured to do so, as described in "Engine Configuration" in config(5).
Several commands use SSL, TLS, or DTLS. By default, the commands use TLS and clients will offer the lowest and highest protocol version
they support, and servers will pick the highest version that the client offers that is also supported by the server.The options below can be used to limit which protocol versions are used, and whether TCP (SSL and TLS) or UDP (DTLS) is used. Note that not all protocols and flags may be available, depending on how OpenSSL was built.
-ssl3, -tls1, -tls1_1, -tls1_2, -tls1_3,
-no_ssl3, -no_tls1, -no_tls1_1, -no_tls1_2, -no_tls1_3
These options require or disable the use of the specified SSL or TLS protocols. When a specific TLS version is required, only that version will be offered or accepted. Only one specific protocol can be given and it cannot be combined with any of the no_ options.
The no_* options do not work with s_time and ciphers commands but work with s_client and s_server commands.The pseudo-command no-XXX tests whether a command of the specified name is available. If no command named XXX exists, it returns 0 (success) and prints no-XXX; otherwise it returns 1 and prints XXX. In both cases, the output goes to
STDOUTand nothing is printed toSTDERR. Additional command line arguments are always ignored. Since for each cipher there is a command of the same name, this provides an easy way for shell scripts to test for the availability of ciphers in the openssl program.-dtls, -dtls1, -dtls1_2
These options specify to use DTLS instead of TLS. With -dtls, clients will negotiate any supported DTLS protocol version. Use the -dtls1 or -dtls1_2 options to support only DTLS1.0 or DTLS1.2, respectively.
Many commands use an external configuration file for some or all of their arguments and have a -config option to specify that file. The default name of the file is openssl.cnf in the default certificate storage area, which can be determined from the openssl-version(1) command using the -d or -a option. The environment variable OPENSSL_CONF can be used to specify a different file location or to disable loading a configuration (using the empty string).
Among others, the configuration file can be used to load modules and to specify parameters for generating certificates and random numbers. See config(5) for details.
-provider name
Load and initialize the provider identified by name. The name can be also a path to the provider module. In that case the provider name will be the specified path and not just the provider module name. Interpretation of relative paths is platform specific. The configured "MODULESDIR" path, OPENSSL_MODULES environment variable, or the path specified by -provider-path is prepended to relative paths. See provider(7) for a more detailed description.-provider-path path
Specifies the search path that is to be used for looking for providers. Equivalently, the OPENSSL_MODULES environment variable may be set.-provparam [name:]key=value
Set configuration parameter key to value in provider name (optional), if name is not specified, the setting will be applied to all loaded providers. This option can be specified multiple times, to set multiple parameters. Options that specify nondefault providers to load should precede this option if the setting is intended to apply to the to be loaded providers. Parameters that only affect provider initialisation must, for now, be set in the configuration file, only parameters that are also queried as needed later have any affect when set via this interface. Only UTF8-string-valued parameters are supported. See the documentation of the specific provider and associated algorithms for any supported parameters.-propquery propq
Specifies the property query clause to be used when fetching algorithms from the loaded providers. See property(7) for a more detailed description.
Generate a random 20 character password, 15 random bytes (8 bits each) will be converted to 20 characters in base 64 (6 bits of entropy per character):
openssl rand -base64 15
Verify a manually-downloaded software update (InstallESD.dmg) from Apple Downloads, which contains a SHA-1 digest
$ openssl sha1 /Volumes/Install\ macOS\ Sequoia\ 15.7.4 /Install\ macOS\ Sequoia.app/Contents/SharedSupport/InstallESD.dmg SHA1(/Volumes/Install macOS Sequoia 15.7.4 /Install macOS Sequoia.app/Contents/SharedSupport/InstallESD.dmg)= 51df126965433187403987c9d74d95c26cba9266The checksum returned can be compared with a list of 'known good' file hashes, unfortunately Apple do not publish any such list, but 3rd party software often will.
encode.sh
#!/bin/bash echo $1 | openssl enc -a -aes-256-cbc -md sha512 -pbkdf2 -iter 1000000 -pass pass:Uni6qePaSSw0rd
decode.sh
#!/bin/bash echo $1 | openssl enc -a -aes-256-cbc -d -md sha512 -pbkdf2 -iter 1000000 -pass pass:Uni6qePaSSw0rd
Make the files above executable:
chmod +x encode.sh decode.sh
Encode example using encode.sh
./encode.sh "an SS64 test string" # => U2FsdGVkX1/8u4x/NQV8ww4Sb6MKIFTRAvv4OFwdvZqNFK1J93H13TROOHgaUF/N
Decode example using decode.sh
./decode.sh U2FsdGVkX1/8u4x/NQV8ww4Sb6MKIFTRAvv4OFwdvZqNFK1J93H13TROOHgaUF/N # => an SS64 test string
“Programming is dreadfully impermanent; it’s more like performance art than literature” ~ Bruce Sterling
Local man page: openssl / openssl-format-options / openssl-passphrase-options /
openssl-verification-options / openssl-namedisplay-options - Command line help page on your local machine.
openssl-format-options (1)
openssl-passphrase-options (1)
openssl-verification-options (1)
openssl-namedisplay-options (1)
openssl-env (7) - Environment variables used by the OpenSSL libraries.
passwd - Modify a user password.
pbcopy - Copy data to the clipboard.
asn1parse(1), ca(1), config(5), crl(1), crl2pkcs7(1), crypto(3), dgst(1), dhparam(1), dsa(1), dsaparam(1), enc(1), gendsa(1), genrsa(1), nseq(1)
pkcs12(1), pkcs7(1), pkcs8(1), rand(1), req(1), rsa(1), rsautl(1), s_client(1), s_server(1), s_time(1), smime(1), spkac(1), ssl(3), verify(1), version(1), x509(1)