SSL Certificate Helper

Genera comandi OpenSSL pronti all'uso per certificati self-signed, CSR e Let's Encrypt. Analizza certificati PEM per estrarne le informazioni principali.

Certificato Self-Signed

Comandi generati

1. Genera la chiave privata RSA
openssl genrsa -out example.com.key 2048

Genera una chiave RSA 2048-bit. Conserva il file .key in modo sicuro e non condividerlo mai.

2. Genera il certificato self-signed
openssl req -new -x509 \
  -key example.com.key \
  -out example.com.crt \
  -days 365 \
  -subj "/CN=example.com/O=My Organization/C=IT" \
  -addext "subjectAltName=DNS:example.com"

Crea un certificato valido per 365 giorni con SAN: DNS:example.com

3. Verifica il certificato generato
openssl x509 -in example.com.crt -text -noout

Stampa i dettagli del certificato per verificarne il contenuto.

Tutti gli strumenti

Come utilizzare SSL Certificate Helper

Choose a mode

Select Self-Signed (local test certificates), CSR (commercial CA request), Let's Encrypt (free certificate via Certbot), or Decode PEM to analyze an existing certificate.

Fill in the required fields

Insert domain, organization, country and, for Let's Encrypt, validation method (webroot, standalone or DNS-01) and contact email.

Copy commands generated in order

Commands for OpenSSL/Certbot are generated in sequence numbered list: copy and execute them in the order indicated on your server terminal.

Check the result

Use the generated verification command (or the Decode PEM tab) to check that the produced certificate contains the expected data.

Suggerimenti

  • Use Let's Encrypt or a commercial CA for production - self-signed certificates generate security warnings in browsers.
  • Activate automatic renewal testing ("certbot renew --dry-run") immediately after obtaining a Let's Encrypt certificate.
  • Keep the generated .key file always in a restricted path and never share it, not even with your CA.

Domande frequenti

Does it actually generate a certificate or just commands?

Generate only OpenSSL/ Certbot ready commands to run on your server: no certificate or private key is generated or sent by the browser.

What's the difference between Self-Signed, CSR and Let's Encrypt?

Self-Signed creates a certificate for local test/dev environment not recognized by browsers; CSR generates a request to send to a commercial Certificate Authority; Let's Encrypt provides the Certbot commands for a free and trusted certificate via the ACME protocol.

What validation method should I choose with Let's Encrypt?

Webroot if the server is already online and serves static files, Standalone if you can temporarily stop Nginx/Apache on port 80, DNS-01 if you need a wildcard certificate via a TXT record in DNS.

What does the "Decode PEM" mode do?

Analyze a PEM certificate attached and extract approximate information such as key algorithm, recognized domains/CN, and partial fingerprint; for a complete analysis, the tool recommends using "openssl x509 -text -noout".

Do I need to share my private key with this tool?

No, never: the tool does not process or require private keys, only generates commands to execute locally on your server.