OpenSSL Commands Reference

import subprocess

def run_openssl(args: list[str]) -> str:
    """Run an openssl command and return stdout."""
    result = subprocess.run(
        ["openssl"] + args,
        capture_output=True, text=True, check=True
    )
    return result.stdout

# Generate a self-signed certificate using subprocess
def generate_self_signed_cert(
    key_path: str = "key.pem",
    cert_path: str = "cert.pem",
    days: int = 365,
    cn: str = "localhost",
    bits: int = 4096,
) -> None:
    # Step 1: generate private key
    subprocess.run(
        ["openssl", "genrsa", "-out", key_path, str(bits)],
        check=True
    )
    # Step 2: generate self-signed cert
    subprocess.run(
        [
            "openssl", "req", "-x509",
            "-key", key_path,
            "-out", cert_path,
            "-days", str(days),
            "-subj", f"/CN={cn}",
        ],
        check=True
    )
    print(f"Certificate written to {cert_path}")

# Read certificate info using cryptography library (pip install cryptography)
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from datetime import datetime, timezone

def inspect_cert(pem_path: str) -> dict:
    with open(pem_path, "rb") as f:
        cert = x509.load_pem_x509_certificate(f.read(), default_backend())
    now = datetime.now(timezone.utc)
    san = cert.extensions.get_extension_for_class(x509.SubjectAlternativeName)
    return {
        "subject": cert.subject.rfc4514_string(),
        "issuer": cert.issuer.rfc4514_string(),
        "not_before": cert.not_valid_before_utc.isoformat(),
        "not_after": cert.not_valid_after_utc.isoformat(),
        "is_expired": cert.not_valid_after_utc < now,
        "serial": cert.serial_number,
        "san": san.value.get_values_for_type(x509.DNSName) if san else [],
    }