OpenSSL Command Generator
Nobody remembers the OpenSSL flag order. Pick what you are trying to do, fill in the details, and copy a command that works. The random secret generator below uses your browser's cryptographic random source, so nothing is transmitted.
Runs entirely in your browser. Nothing you paste is uploaded.
openssl rand -base64 24
Recent Keys
About the OpenSSL Command Generator
OpenSSL's interface is famously unforgiving because a single binary covers key generation, certificate signing, inspection, and conversion between half a dozen encodings. The commands here cover the cases that come up when you are standing up a service: an RSA or ECDSA private key, a certificate signing request, a self-signed certificate for local development, and the inspection commands to verify what you just made.
For secrets, prefer openssl rand -hex 32 or the generator on this page over anything derived from a password. A 32-byte random value has 256 bits of entropy; a memorable passphrase has closer to 40.
Frequently asked questions
Should I use RSA or ECDSA?
ECDSA with the P-256 curve for anything new. It gives comparable security to RSA-3072 with much smaller keys and faster handshakes. Use RSA-2048 or higher only when something in your stack cannot handle elliptic curves.
Is the secret generated here safe to use?
It comes from crypto.getRandomValues(), the browser's CSPRNG, and is generated locally. Nothing is sent anywhere. That said, for production secrets, generating on the target machine with openssl rand is the better habit.
How do I inspect a certificate I already have?
openssl x509 -in cert.pem -noout -text prints everything. Add -dates for just the validity window, which is usually the thing you actually wanted.