I stopped memorizing openssl flags

Every few weeks I need to do something with a certificate. Check when it expires. Look at what SANs are on it. Generate a self-signed one for local dev. Create a CSR. Convert between formats.

And every single time, I google the openssl command.

It's not that the commands are hard. It's that they're inconsistent enough that I can never quite remember them. Is it openssl x509 -in or openssl x509 -text? Do I need -noout? What about the s_client pipeline thing where I have to pipe through two commands just to see a cert from a live server?

I've been writing software for years. I can hold a lot of random CLI syntax in my head. But openssl never sticks. The subcommands follow no pattern I can internalize, and the flags feel like they were designed by committee across two decades. Which, to be fair, they were.

what I actually do with certificates#

When I thought about it, my cert tasks fall into maybe 10 categories:

• Look at a cert file
• Connect to a server and see its TLS setup
• Check if a cert is expiring soon (across multiple hosts)
• Generate a self-signed cert for development
• Create a CSR
• Convert between PEM/DER/PKCS12
• Check if a cert and private key match
• Grade a server's TLS configuration
• Decode a JWT (yeah, this comes up more than I expected)
• Verify a certificate chain

That's it. I'm not running a certificate authority. I'm not doing low level crypto operations. I'm doing the same 10 things over and over, and reaching for a tool that does 200 things, most of which I'll never touch.

the openssl tax#

Here's what some of these look like in openssl:

# check when a remote cert expires
echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -enddate

# generate a self-signed cert with EC key and SANs
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 \
  -keyout key.pem -out cert.pem -days 365 -nodes -batch \
  -subj "/CN=localhost"

# check if cert and key match
diff <(openssl x509 -noout -modulus -in cert.pem) \
     <(openssl rsa -noout -modulus -in key.pem)

I call it a tax because it's time I spend repeatedly, on something that should be simple, and the complexity doesn't buy me anything. I don't need openssl's full power. I need the 10 things.

so I built the 10 things#

I wrote a tool called sslx. Same tasks, less typing:

# check when a remote cert expires
sslx expiry host

# generate a self-signed cert
sslx generate --cn localhost

# check if cert and key match
sslx match cert.pem key.pem

The pattern is: sslx <verb> <target>. That's it. No subcommand soup, no flags you need to memorize. The verbs are the same words you'd use if you were describing the task out loud.

Here's the full comparison:

what the output looks like#

This is probably the part that sold me on actually using it daily. openssl gives you a wall of ASN.1 text. sslx gives you the parts you care about:

$ sslx grade github.com

  ╭──────────────────────────────────────────╮
  │  github.com:443                  Grade: A+  │
  ╰──────────────────────────────────────────╯

  ✓ Protocol      TLS 1.3
  ✓ Cipher        TLS13_AES_128_GCM_SHA256 (AEAD)
  ✓ Certificate   Valid, 49 days remaining
  ✓ Key           ECDSA P-256 (256 bit)
  ✓ Hostname      github.com in SANs
  ✓ Chain         Complete (3 certs)
  ✓ ALPN          HTTP/2 supported

Or checking expiry across a bunch of hosts at once:

$ sslx expiry google.com github.com cloudflare.com stripe.com

  Host                           Expires          Days  Status
  ────────────────────────────────────────────────────────────────
  ✓ google.com:443                 2026-06-15         61  OK
  ✓ github.com:443                 2026-06-03         49  OK
  ✓ cloudflare.com:443             2026-06-10         56  OK
  ✓ stripe.com:443                 2026-09-01        139  OK

The expiry command returns exit code 1 if anything expires within 7 days. I have this in a cron job now.

CI/CD and scripting#

Everything supports --json for when you need machine readable output:

sslx grade example.com --json | jq '.grade'
sslx inspect cert.pem --json | jq '.certificates[0].sans'

And you can pipe certs from stdin:

cat cert.pem | sslx inspect -
kubectl get secret tls-cert -o jsonpath='{.data.tls\.crt}' | base64 -d | sslx inspect -

That second one is real. I use it to check certs stored in k8s secrets without writing temp files.

the technical bits, briefly#

It's written in Rust, single binary, no runtime dependencies. Uses rustls instead of linking against system OpenSSL, so it works the same everywhere. About 4MB.

It's fast too, though I don't think that matters much for a cert tool. sslx inspect on a local cert takes about 2ms.

Install with cargo or homebrew:

cargo install sslx
# or
brew install glincker/tap/sslx

what it doesn't do#

sslx is not a replacement for openssl the library. It doesn't do symmetric encryption, PKCS operations, S/MIME, or any of the hundred other things openssl can do. If you need those, use openssl.

It replaces the 10 cert/TLS commands I kept googling. Nothing more.

github.com/glincker/sslx

If you have opinions about what commands are missing or how the output should look, open an issue. I'm using this daily so I actually read them.