What is OpenSSL?
OpenSSL is a free, open-source cryptography toolkit that powers SSL and TLS across most of the internet. It includes a library used by web servers and other software, and a command-line tool developers use to inspect, generate, and verify certificates and keys.
OpenSSL is two things that share a name: a cryptography library that runs inside most web servers, mail servers, and VPNs, and a command-line tool that developers and sysadmins use directly to inspect, generate, and verify certificates and keys. Most of the time, both are installed together.
It is free, open-source software maintained by the OpenSSL Project and licensed under an Apache-style licence. The library underpins an enormous share of the internet's encrypted traffic, which is why OpenSSL security advisories tend to attract wide attention.
The library and the tool
The libssl and libcrypto libraries are what most software links against. When Nginx, Apache, Postfix, or OpenSSH establish a TLS connection, they are almost always calling into one of these libraries. You do not interact with them directly; they do their work in the background.
The openssl command-line utility is what you run in a terminal. It is a single binary with dozens of sub-commands. The ones used most often for certificate work are:
openssl s_client: connect to a live server and inspect its certificateopenssl x509: read, decode, or convert a certificate fileopenssl req: generate or inspect a certificate signing request (CSR)openssl verify: validate a certificate against a CA bundleopenssl pkey: work with private keys
These are covered in detail in the guide: How to Check an SSL Certificate with OpenSSL.
OpenSSL and TLS
Despite the name, OpenSSL no longer primarily handles SSL, as that protocol has been retired. What it actually implements today is TLS (Transport Layer Security), specifically TLS 1.2 and TLS 1.3. The name has stuck because SSL was the original protocol the library was built around.
When a browser and a server complete a TLS handshake, both sides are almost certainly using OpenSSL or a library derived from it (BoringSSL in Chrome, LibreSSL on some BSD systems). The certificate your browser sees (the one that shows the padlock and confirms the domain) was likely signed, inspected, and verified with OpenSSL tooling at some point in its life.
What developers use it for
In day-to-day SSL/TLS work, OpenSSL comes up most often for:
- Checking expiry dates: running
openssl x509 -noout -enddateagainst a certificate file or a live server - Inspecting the certificate chain: using
openssl s_client -showcertsto see every certificate a server sends, and whether the chain leads to a trusted root - Generating CSRs: creating the certificate signing requests sent to a certificate authority when applying for a certificate
- Verifying a cert matches its key: comparing public key hashes to confirm a renewed certificate and its private key are a matching pair
- Testing TLS protocol support: forcing a specific TLS version to confirm whether a server accepts it
For scripts and monitoring, the -checkend flag is particularly useful: it exits with a non-zero code if the certificate expires within a given number of seconds, making it easy to trigger alerts.
OpenSSL is built for one-off inspection. ChillSSL SSL monitoring watches your certificates continuously and alerts you before they expire. No commands required.
Related reading
Where You'll See This Term
This term commonly appears in:
- SSL certificate details pages
- Certificate Authority validation processes
- SSL configuration documentation
- Security audit reports
- Certificate management interfaces