OpenSSL — outil — sheet.sec

#Inspecter un certificat TLS

bash

# Chaîne complète
openssl s_client -connect example.com:443 -servername example.com </dev/null

# Certificat lisible
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -text

# Dates, sujet, émetteur, SAN
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

bash

# Vérifier un fichier
openssl x509 -in cert.pem -noout -text
openssl verify -CAfile ca.pem cert.pem

# Convertir DER → PEM
openssl x509 -in cert.der -inform der -out cert.pem

#Générer des clés

bash

# Clé RSA 4096
openssl genrsa -out key.pem 4096

# Clé EC P-256
openssl ecparam -name prime256v1 -genkey -noout -out key.pem

# CSR
openssl req -new -key key.pem -out request.csr \
  -subj "/C=FR/ST=IDF/L=Paris/O=Example/CN=example.com"

# Certificat auto-signé (lab)
openssl req -x509 -newkey rsa:2048 -nodes -days 365 \
  -keyout key.pem -out cert.pem -subj "/CN=lab.local"

#Chiffrer et déchiffrer

bash

# AES-256-CBC avec passphrase
openssl enc -aes-256-cbc -pbkdf2 -salt -in clear.txt -out secret.enc
openssl enc -d -aes-256-cbc -pbkdf2 -in secret.enc -out clear.txt

# Base64
openssl base64 -in file.bin -out file.b64
openssl base64 -d -in file.b64 -out file.bin

bash

# Chiffrement asymétrique (petits fichiers)
openssl pkeyutl -encrypt -pubin -inkey public.pem -in clear.txt -out secret.enc
openssl pkeyutl -decrypt -inkey private.pem -in secret.enc -out clear.txt

#Hashes et signatures

bash

# Empreintes
openssl dgst -sha256 file.bin
openssl dgst -sha512 file.bin

# HMAC
openssl dgst -sha256 -hmac 'secret' file.bin

# Signature et vérification
openssl dgst -sha256 -sign key.pem -out sig.bin file.bin
openssl dgst -sha256 -verify public.pem -signature sig.bin file.bin

#PKCS#12 et keystores

bash

# PEM → PFX
openssl pkcs12 -export -out bundle.pfx -inkey key.pem -in cert.pem -certfile ca.pem

# PFX → PEM
openssl pkcs12 -in bundle.pfx -nodes -out bundle.pem

# Extraire la clé et le certificat
openssl pkcs12 -in bundle.pfx -nocerts -nodes -out key.pem
openssl pkcs12 -in bundle.pfx -clcerts -nokeys -out cert.pem

#Tester un serveur

bash

# Forcer TLS 1.2 et une cipher précise
openssl s_client -connect example.com:443 -tls1_2 -cipher 'ECDHE-RSA-AES256-GCM-SHA384'

# Vérifier SNI et ALPN
openssl s_client -connect 10.10.10.10:443 -servername example.com -alpn h2

# Énumérer les ciphers (nmap)
nmap -p 443 --script ssl-enum-ciphers example.com