Read cert
$ openssl s_client -host <hostname> -port 443 | openssl x509 -noout -text
Read cert and check
$ echo | openssl s_client -servername <hostname> -connect <hostname>:443 -CAfile /etc/ssl/cert.pem | openssl x509 -noout -text
Dump cert chain
$ openssl s_client -showcerts -servername <hostname> -connect <hostname>:443
Read CRL
$ openssl crl -inform {DER|PEM} -noout -text -in <crl file>
Test connection
$ openssl s_client -servername <hostname> -connect <hostname>:443 -CAfile <Root CA cert file>
Convert DER to PEM
$ openssl x509 -inform DER -in cert.der -outform PEM -out cert.pem
Verify cert chain
$ openssl verify -CAfile /etc/ssl/cert.pem -untrusted intermediate.pem cert.pem
Exctract certs from pkcs12 file
$ openssl pkcs12 -in <file.pfx> -nodes
Extract keys from pkcs12 file
$ openssl pkcs12 -in <file.pfx> -nocerts
Remove password from key PEM
$ openssl rsa -in <protected.pem> -out <unprotected.pem>