TLS/SSL certificate CSR

 
# CSR
openssl req -new -newkey rsa:4096 -keyout domain.key -out domain.csr


# Remove key password
openssl rsa -in encrypted.key -out decrypted.key


chain = crt + intermediary

Certificate - PEM to PKCS12

 

Convert Lets encrypt PEM to tomcat PKCS12 

openssl pkcs12 -export \ -in fullchain.pem \ -inkey privkey.pem \ -out server.p12 \ -name my-domain-alias 

Renew OpenVPN certificate

 mv /etc/openvpn/easy-rsa/pki/reqs/server_xyzblablabla.req server_xyzblablabla.req.backup

mv /etc/openvpn/easy-rsa/pki/private/server_xyzblablabla.key server_xyzblablabla.key.backup

mv /etc/openvpn/easy-rsa/pki/issued/server_xyzblablabla.crt server_xyzblablabla.crt.backup

mv /etc/openvpn/server_xyzblablabla.crt server_xyzblablabla.crt.backup

mv /etc/openvpn/server_xyzblablabla.key server_xyzblablabla.key.backup

cd /etc/openvpn/easy-rsa

./easyrsa build-server-full server_xyzblablabla nopass

cp /etc/openvpn/easy-rsa/pki/issued/server_xyzblablabla.crt /etc/openvpn

cp /etc/openvpn/easy-rsa/pki/private/server_xyzblablabla.key /etc/openvpn

Verify certificates

 3. Verify that the Public Keys contained in the Private Key file and the Main/Server Certificate are the same:

openssl x509 -in certificate.pem -noout -pubkey
openssl rsa -in ssl.key -pubout

The output of these two commands should be the same.
 
4. Check that the Valid From and Valid To dates of the certificate are correct:

openssl x509 -noout -in certificate.pem -dates

Ensure that the current date is between the certificate's Not Before and Not After dates.
 
5. Check the validity of the Certificate Chain:

openssl verify -CAfile certificate-chain.pem certificate.pem

If the response is OK, the check is valid.

Certificate expire date:

openssl x509 -enddate -noout -in server.crt

https://acquia.my.site.com/s/article/360004119234-Verifying-the-validity-of-an-SSL-certificate

 

https://forums.openvpn.net/viewtopic.php?t=18671

JKS and Openssl commands

Java Keytool Command

These commands allow you to generate a new Java Keytool keystore file, create a CSR, and import certificates. Any root or intermediate certificates will need to be imported before importing the primary certificate for your domain.

• Generate a Java keystore and key pair

  keytool -genkey -alias mydomain -keyalg RSA -keystore keystore.jks -keysize 2048

• Generate a certificate signing request (CSR) for an existing Java keystore

  keytool -certreq -alias mydomain -keystore keystore.jks -file 8gwifi.csr

• Import a root or intermediate CA certificate to an existing Java keystore

  keytool -import -trustcacerts -alias root -file 8gwifiCA.crt -keystore keystore.jks

• Import a signed primary certificate to an existing Java keystore

  keytool -import -trustcacerts -alias mydomain -file mydomain.crt -keystore keystore.jks

• Generate a keystore and self-signed certificate  

  keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360 -keysize 2048

• Check a stand-alone certificate

  keytool -printcert -v -file 8gwifi.crt

• Check which certificates are in a Java keystore

  keytool -list -v -keystore keystore.jks

• Check a particular keystore entry using an alias

  keytool -list -v -keystore keystore.jks -alias mydomain

• Delete a certificate from a Java Keytool keystore

  keytool -delete -alias 8gwifi -keystore keystore.jks

• Change a Java keystore password

  keytool -storepasswd -new new_storepass -keystore keystore.jks

• Export a certificate from a keystore

  keytool -export -alias mydomain -file mydomain.crt -keystore keystore.jks

• List Trusted CA Certs

  keytool -list -v -keystore $JAVA_HOME/jre/lib/security/cacerts

• Import New CA into Trusted Certs

  keytool -import -trustcacerts -file /path/to/ca/ca.pem -alias CA_ALIAS -keystore $JAVA_HOME/jre/lib/security/cacerts

• 
  

OpenSSL Commands

• Generate a new private key and Certificate Signing Request

  openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privatekey.key

• Generate a self-signed certificate 

  openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privatekey.key -out certificate.crt

• Generate a certificate signing request (CSR) for an existing private key

  openssl req -out CSR.csr -key privatekey.key -new

• Generate a certificate signing request based on an existing certificate

  openssl x509 -x509toreq -in certificate.crt -out CSR.csr -signkey privatekey.key

• Remove a passphrase from a private key

  openssl rsa -in privateKey.pem -out newprivatekey.pem

• Convert a DER file (.crt .cer .der) to PEM

  openssl x509 -inform der -in certificate.cer -out certificate.pem

• Convert a PEM file to DER

  openssl x509 -outform der -in certificate.pem -out certificate.der

• Convert a PKCS#12 file (.pfx .p12) containing a private key and certificates to PEM

  openssl pkcs12 -in keyStore.pfx -out keystore.pem -nodes

  You can add -nocerts to only output the private key or add -nokeys to only output the certificates.

• Convert a PEM certificate file and a private key to PKCS#12 (.pfx .p12)

  openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile