OpenSSL and certificates

OpenSSL

.csr - Certificate Signing Request
.pem - certificate container
-----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- show a CSR in PEM format.
-----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY----- show a private key in PEM format.
-----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- show a certificate file in PEM format.
.key - PEM formatted file containing just private-key
.p12 - Passworded certificate container that contains both public and private certificate pairs
.der - a .pem file is just a Base64 encoded .der file
.crt - a .pem (or rarely .der) file recognized by Windows


# Generate 2048 bit RSA private key
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" genrsa -out server.key 2048
# Generate CSR
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" req -new -key server.key -out server.csr -nodes -subj "/CN=localhost"
# Generate 2048 bit RSA private key and CSR
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" req -newkey rsa:2048 -keyout server.key -out server.csr -nodes -subj "/CN=localhost"

# Generate self-signed x509 cert from private key and CSR
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" x509 -req -in server.csr -signkey server.key -days 365 -out server.crt

# Generate 2048 bit RSA private key and self-signed x509 cert (no CSR)
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" req -x509 -newkey rsa:2048 -keyout server.key -out server.crt -days 365 -nodes -subj "/CN=localhost"

# Print self-signed x509 cert
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" x509 -in server.crt -text -noout
# Print CSR
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" req -in server.csr -text -noout

# Generate PKCS12 from private key and cert
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -inkey server.key -in server.crt -export -out keystore.p12
# Convert PKCS12 to PEM
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -in keystore.p12 -nodes -out server.pem
# Generate PKCS12 from PEM
"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -export -in server.pem -out keystore.p12