OpenSSL Command Generator
Fill in the fields and copy a ready-to-run OpenSSL command. Nothing is generated here — you run the command locally, so your private key never touches a web page.
Command
How to use this tool
- Pick what you need: a self-signed certificate, a CSR to send to a CA, a format conversion, or an inspection command.
- Fill in the fields — the command rebuilds as you type. For certificates, always add at least one Subject Alternative Name; browsers have ignored the Common Name for years.
- Copy the command and run it in your own terminal. Nothing is generated on this page, so your private key is created locally and never leaves your machine.
- Read the note under each command — it explains the flags that matter, like
-nodesfor a passphrase-free server key. - For a live server, use the Inspect tab's connection test to see the real certificate a host is serving, SNI included.
OpenSSL is the tool everyone reaches for and nobody remembers the syntax of. The flags are terse, the subcommands (req, x509, pkcs12, s_client) each have their own grammar, and a single wrong argument produces a confusing error or, worse, a certificate that silently does the wrong thing. This generator produces the exact command for the common tasks so you are not stitching one together from three Stack Overflow answers.
The design decision that matters here: this page never generates your key. Some online certificate tools create the private key in the browser and hand it to you — which means a private key was generated in software you do not control, and you have no way to verify it was not logged. That is an unacceptable risk for anything real. Everything here is a command you run locally, so the key is produced by your own OpenSSL and never transits a web page.
The most common self-signed-certificate mistake in 2026 is relying on the Common Name. Browsers stopped honouring CN for hostname matching years ago and require a SubjectAltName extension instead. A certificate with CN=example.com and no SAN will throw ERR_CERT_COMMON_NAME_INVALID in Chrome regardless of how correct the CN looks. This tool adds -addext \"subjectAltName=...\" for you and warns when you have left it empty.
For real certificates you want a CSR, not a self-signed cert. The certificate signing request carries your public key and subject details to a Certificate Authority, which signs it. The private key never leaves your server — that is the whole point of the CSR flow. Keep key.pem secret and send only the .csr. Since 2020, public CAs cap certificate lifetimes (398 days, dropping further), so the -days field only matters for self-signed and internal certs.
The Inspect tab covers the debugging half of the job, which is where most real time goes. openssl s_client -connect host:443 -servername host shows you the certificate a live server actually serves — note -servername, which sends SNI so you get the right cert on a shared host. And the modulus-comparison recipe answers the perennial \"does this key go with this certificate\" question: if the two MD5 hashes match, they are a pair.
Frequently asked questions
Why does my self-signed certificate fail with ERR_CERT_COMMON_NAME_INVALID?
Because it has no SubjectAltName. Modern browsers ignore the Common Name entirely for hostname validation and require a SAN extension. Add every hostname you will use as a SAN — this tool does that with -addext. A cert with only a CN will fail even when the CN is exactly right.
Is it safe to generate a private key in an online tool?
No, and that is why this tool does not. A key generated in a web page was produced by code you cannot audit and might be logged. This generator only builds the command; you run it locally so OpenSSL on your own machine creates the key. It never touches the network.
What does the -nodes flag actually do?
It leaves the private key unencrypted — \"no DES\". You almost always want it for a server key, because an encrypted key makes the server prompt for a passphrase every time it starts, which breaks unattended reboots. For a key you will store in a password manager and use interactively, omit it.
What is the difference between PEM, DER and PKCS#12?
PEM is base64 text with -----BEGIN----- headers — the Linux default. DER is the same data as raw binary, preferred by Java and Windows. PKCS#12 (.pfx/.p12) bundles a certificate and its private key together in one password-protected file, which is what IIS and many Java keystores import. The Convert tab moves between all three.
How do I check whether a private key matches a certificate?
Compare their moduli. Run openssl x509 -noout -modulus -in cert.pem | openssl md5 and openssl rsa -noout -modulus -in key.pem | openssl md5; identical hashes mean they are a pair. The Inspect tab builds this for you. For EC keys, compare the public keys with -pubkey instead.