How to inspect a certificate with OpenSSL
You will have read a certificate file or a server's certificate with OpenSSL and found its names, dates, issuer, key and fingerprint.
How-to guides
How-to guides
Step-by-step guides for the jobs people actually do with certificates: check, create, convert, trust, install and automate. Real commands, real output, and never "turn off verification".
35 of 35 guides published in this early edition.
Each guide takes one real task from start to finish: inspecting a certificate, creating a CSR, converting a PFX, trusting a private root, installing a certificate or automating renewal. We run the commands for real wherever we can and show their real output, and every guide ends with a check that proves it worked, the problems you are most likely to meet, and the handbook chapter that explains why it works. None of them asks you to switch certificate checking off or to paste a private key into a website.
Inspect and check
Read a certificate, check the chain a server sends, and prove a key matches.
How to check the certificate chain a server sends
You will have listed every certificate a server sends, checked their order and links, and verified the chain with a strict client instead of a browser.
How to check that a private key matches a certificate
You will have proved, without exposing the key, that a private key, its CSR and a certificate share one public key, or found the file that does not belong.
Create keys and CSRs
Make a key pair and a certificate signing request on any platform.
How to create a key and a CSR with OpenSSL (with SANs)
You will have a new private key that never leaves your server, and a verified certificate signing request that lists every name your certificate needs.
How to create a CSR on Windows (certreq and IIS)
You will have a CSR with all your names, whose private key stays inside the Windows key store, and know how to install the certificate when it returns.
How to create a CSR with Java keytool
You will have a key pair in a PKCS #12 keystore, a CSR whose SAN list really reaches the CA, and the signed certificate chain installed under the same alias.
Convert file formats
Move certificates and keys between PEM, DER, PFX and Java keystores.
How to convert PFX (PKCS #12) to PEM and back
You will have split a PFX into PEM files for the certificate, the chain and the key, or packed PEM files into a PFX that Windows and Java can import.
How to convert between DER and PEM
You will have identified whether a file is DER or PEM and converted certificates, keys, CSRs, CRLs and bundles between the two, with proof that nothing changed.
How to convert a Java keystore (JKS) to PKCS #12
You will have moved every key and trusted certificate from a JKS keystore into a standard PKCS #12 file that Java, OpenSSL and Windows can read, and updated your settings.
Trust a CA
Make computers, languages and tools trust a private or corporate CA, safely.
How to work behind a TLS-inspecting corporate proxy, safely
You will have confirmed that your traffic is inspected, obtained your company's inspection root through a trusted channel, and made each tool trust it with verification still on.
How to trust a private root CA on Windows
Your Windows computer, or a whole fleet, trusts your organisation's private root CA, and you know which apps still need their own setting.
How to trust a private root CA on macOS
Your Mac, or every managed Mac, trusts your organisation's private root CA in the System keychain, and you know which apps need their own setting.
How to trust a private root CA on Linux
Your Linux server, desktop or container image trusts your organisation's private root CA system-wide, and you know which programs keep their own list.
How to add a CA to a Java trust store (cacerts)
Your Java program trusts your private root CA, either through the JDK's cacerts or through its own trust store, and you have proved it with a real connection.
How to make Python, Node.js and npm trust a private CA
Python, pip, requests, Node.js and npm trust your private root CA, through the operating system's store or a bundle file, with verification still fully on.
Install on a server
Put a certificate and its chain on nginx, Apache, IIS and Java servers.
How to build the full chain file your server needs
You will have one PEM file with your certificate followed by its intermediates in the right order, verified offline and proven to work with a strict client.
How to install a certificate in nginx
nginx serves your certificate and its full chain on port 443, with a key that matches, and you have proved it from the outside with OpenSSL and curl.
How to install a certificate in Apache httpd
Apache httpd serves your certificate with its full chain from one SSLCertificateFile, with a matching key, and you have proved it from outside.
How to install a certificate in IIS
IIS serves your certificate with its private key and intermediate on an HTTPS binding with SNI, and renewed certificates get rebound instead of silently expiring.
How to install a certificate in Tomcat and other Java servers
Tomcat, or a Spring Boot or other Java server, serves your certificate with its full chain from PEM files or a PKCS #12 keystore, verified from outside.
Automate renewal
Get and renew certificates without a human: certbot, cert-manager, win-acme.
How to get and renew Let's Encrypt certificates with certbot
certbot gets a Let's Encrypt certificate for your Linux server, installs it, renews it automatically on the CA's schedule, and reloads your web server each time.
How to automate certificates in Kubernetes with cert-manager
cert-manager issues Let's Encrypt certificates for your Kubernetes Ingresses or Certificate resources, stores them in Secrets and renews them before they expire.
How to automate certificates on Windows with win-acme
win-acme gets Let's Encrypt certificates for your IIS sites, binds them, and renews them every day from a scheduled task that follows the CA's renewal advice.
How to get a wildcard certificate with DNS-01
You will have a publicly trusted certificate for *.example.com and example.com, issued through the ACME DNS-01 challenge with a narrowly scoped DNS key, and renewing by itself.
Operate and monitor
Watch expiry and Certificate Transparency, and get ready for short lifetimes.
How to check when a certificate expires, and monitor it
You will have read expiry dates in files, live servers and certificate stores, and set up a check that warns before any certificate in a chain runs out.
How to monitor Certificate Transparency for your domains
You will have a scheduled check that lists every new publicly trusted certificate for your domains and flags any certificate issued by a CA you did not allow.
How to prepare for short-lived certificates: a checklist
You will have a dated plan that moves every public TLS certificate to automated renewal, with an inventory, owners, ARI, independent monitoring and a budget, before lifetimes shrink.
Harden and secure
TLS settings, CAA records and mutual TLS done properly.
How to set CAA records for your domain
You will have DNS CAA records that let only the CAs you really use issue certificates for your names, with separate wildcard rules and an address for violation reports.
How to configure TLS securely (versions, ciphers, HSTS)
You will have a web server that offers only TLS 1.2 and 1.3 with forward-secret ciphers, staples OCSP only where it still applies, sends HSTS safely, and passes testing.
How to set up mutual TLS (nginx and curl)
You will have an nginx endpoint that accepts only clients holding a certificate from your own client CA, lets in only the clients you name, and is tested with curl.
Labs and advanced
Private CAs, code signing, SSH certificates and post-quantum TLS.
How to run a small private CA with step-ca (lab)
You will have a lab CA running smallstep's step-ca that issues and renews 24-hour certificates, speaks ACME, and refuses names outside your lab domain.
How to build a test CA with OpenSSL (lab only)
You will have a two-tier test CA built with openssl ca: a root, a name-constrained issuing CA, server and client certificates, a revocation and working CRLs.
How to sign code with signtool and cosign
You will sign and timestamp a Windows program with SignTool, sign a release file with Sigstore cosign, and verify both, including who signed and when.
How to use SSH certificates instead of known_hosts
You will have OpenSSH host and user certificates signed by your own CAs, so clients trust servers without first-use prompts and servers trust short-lived user certificates.
How to test post-quantum hybrid TLS
You will know whether your servers and network negotiate the X25519MLKEM768 hybrid key exchange, and how to read, force and troubleshoot it with OpenSSL 3.5.