Generate a new RSA key of 4096 bits. Adding the -des3 (or any other cipher) requires that the key have a password issued:
openssl genrsa -out server.key 2048
Generate a new CSR (Certificate Signed Request)
openssl req -new -key server.key -out server.csr
Generate a new SSL certificate using the CSR and the keyfile:
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Optional remove the password from a key
openssl rsa -in server.key.org -out server.key (remove passphrase from key)
Generate a key, create a CSR
$ openssl genrsa -out chirpify.key 2048
$ openssl req -new -key server.key -out server.csr
Verify a certificate by comparing the MD5 signatures of the modulus for the key and the certificate. They should be identical.
openssl x509 -noout -modulus -in STAR_chirpify_com.crt | openssl md5
Same for private key
openssl rsa -noout -modulus -in chirpify.key | openssl md5
See https://kb.wisc.edu/middleware/page.php?id=4064 for more
Extract the public part of an SSL RSA key
openssl rsa -in ~/.ssh/staging.pem -out staging.pub -outform PEM -pubout