How to use OpenSSL command line on Debian

The OpenSSL command line tool under the Debian system is powerful and can be used for various tasks such as key pair generation, certificate creation and management, data encryption and decryption. This article will guide you to quickly get started with OpenSSL.

1. OpenSSL installation

First, make sure your Debian system has OpenSSL installed. If not installed, execute the following command:

 sudo apt update
sudo apt install openssl

2. Key pair generation

1. Generate RSA private key:

 openssl genrsa -out private.key 2048

This command generates a 2048-bit RSA private key and saves it to the private.key file.

2. Generate RSA public key:

 openssl rsa -in private.key -pubout -out public.key

This command extracts the public key from private.key and saves it to the public.key file.

3. Creation of self-signed certificates

 openssl req -new -x509 -days 365 -key private.key -out certificate.crt

This command creates a self-signed certificate with a validity period of 365 days and saves it to the certificate.crt file. During the execution process, the system will prompt you to enter information such as country, organization name, etc.

4. Data encryption and decryption

1. File encryption:

 openssl enc -aes-256-cbc -salt -in plaintext.txt -out encrypted.bin

This command uses the AES-256-CBC algorithm to encrypt the plaintext.txt file, and the encryption results are saved to the encrypted.bin file. You will be prompted for a password.

2. File decryption:

 openssl enc -d -aes-256-cbc -in encrypted.bin -out decrypted.txt

This command uses the same password to decrypt the encrypted.bin file, and save the decryption result to the decrypted.txt file.

5. Certificate information viewing and verification

1. View certificate information:

 openssl x509 -in certificate.crt -text -noout

This command displays certificate details, including subject, issuer, validity period, etc.

2. Verify the certificate signature:

 openssl verify -CAfile ca.crt certificate.crt

This command verifies whether certificate.crt is issued by ca.crt .

6. Certificate Signing Request (CSR) and PKCS#12 file generation and operation

1. Generate CSR:

 openssl req -new -key private.key -out certificate_signing_request.csr

This command generates a CSR file to apply for a certificate from the Certificate Authority (CA).

2. Generate PKCS#12 file:

 openssl pkcs12 -export -in certificate.crt -inkey private.key -out keystore.p12 -name mycert

This command packages the certificate and private key into a PKCS#12 file, alias mycert .

3. Extract certificate and private key from PKCS#12 file:

• Extract certificates:

   openssl pkcs12 -in keystore.p12 -clcerts -nokeys -out certificate.crt

• Extract the private key:

   openssl pkcs12 -in keystore.p12 -nocerts -out private.key -nodes

The above commands cover common functions of OpenSSL under Debian system. For more advanced features, please refer to the official OpenSSL documentation.

The above is the detailed content of How to use OpenSSL command line on Debian. For more information, please follow other related articles on the PHP Chinese website!