OpenSSL Library

A Web Standard
OpenSSL is an open-source software library and command-line tool used to implement SSL (Secure Sockets Layer) and TLS (Transport Layer Security) protocols, which secure communications over computer networks. It provides cryptographic functions such as encryption, decryption, key generation, and certificate management, making it essential for internet security, web servers, email systems, and VPNs. [rc6zs1] [z5qug0] [x18qii]
Purpose of Creation: OpenSSL was created in 1998 as a fork of the SSLeay library to provide a free and open-source implementation of SSL/TLS protocols. Its goal was to enhance secure communications on the internet by offering robust encryption tools. [z5qug0] [9i5g74]
Universality: OpenSSL is highly universal, being used by over 79% of websites in the web server extensions category. It supports most operating systems, including Linux, Windows, macOS, and others. It is widely integrated into tools like Apache, PHP, and WordPress. [dpx9qn] [x18qii]
Maintaining Organization: The OpenSSL Software Foundation (OSF) oversees its development and legal matters, while OpenSSL Software Services (OSS) handles support contracts. The project relies on donations and has a small team of full-time employees supported by volunteers. [z5qug0]
To generate SSL certificates using OpenSSL, follow these steps:

1. Generate a Self-Signed Certificate

This is useful for testing or internal use.
bash 
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:4096 -keyout private.key -out certificate.crt
  • -x509: Creates a self-signed certificate.
  • -sha256: Uses SHA-256 for hashing.
  • -nodes: Skips encrypting the private key.
  • -days 365: Sets the certificate validity to 365 days.
  • -newkey rsa:4096: Generates a new 4096-bit RSA privacy [rc6zs1] [z5qug0] [9i5g74]

2. Generate a Certificate Signing Request (CSR)

Use this to request a certificate from a trusted Certificate Authority (CA).
bash 
openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr
  • -new: Creates a new CSR.
  • -newkey rsa:2048: Generates a new 2048-bit RSA private key.
  • -nodes: Prevents encryption of the privacy [rc6zs1] [z5qug0] .

3. Verify Certificates and CSRs

To check the contents of a generated certificate or CSR:
bash 
openssl x509 -in certificate.crt -text -noout
openssl req -in request.csr -text -noout
This outputs human-readable details for verification [rc6zs1] [z5qug0]

4. Advanced Use: Create a Local Certificate Authority (CA)

To create your own CA for local development:
  1. Generate a CA private key:
    bash 
    openssl genrsa -des3 -out myCA.key 2048
  2. Create a root certificate:
    bash 
    openssl req -x509 -new -nodes -key myCA.key -sha256 -days 3650 -out myCA.pem
This allows signing certificates. [dpx9qn]

Sources

[rc6zs1] What Is OpenSSL and How Does It Work? - SSL Dragon https://www.ssldragon.com/blog/what-is-openssl/