# TLS Certificates Know-How & Quick-Reference

**URL:** https://collective.flashbots.net/t/tls-certificates-know-how-quick-reference/5292
**Category:** BuilderNet
**Created:** [September 23, 2025, 7:23pm UTC](https://collective.flashbots.net/t/tls-certificates-know-how-quick-reference/5292 "2025-09-23T19:23:33Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![metachris](https://collective.flashbots.net/user_avatar/collective.flashbots.net/metachris/32/6_2.png) [@metachris](https://collective.flashbots.net/u/metachris)
#### Post date: [September 23, 2025, 7:23pm UTC](https://collective.flashbots.net/t/tls-certificates-know-how-quick-reference/5292/1 "2025-09-23T19:23:33Z")

</div>

This post is a practical TLS quick-reference: keys, certs, CSRs, CA chains, validation, and curl testing.

We recently added trusted TLS certificates to BuilderNet using Let’s Encrypt (ACME), and wanted to share some things we’ve learned in that process and found particularly useful.

 ![cover-tls](https://collective.flashbots.net/uploads/default/original/2X/2/232aa7e7f9fef8e1fd2b13440475adc232824742.jpeg)

# About TLS

Transport Layer Security (TLS) is a cryptographic protocol that provides secure communication over a computer network using public key cryptography and digital certificates to authenticate the communicating parties and to encrypt the data transmitted between them.

A TLS certificate contains:

1. A public key, corresponding to a private key owned by the entity presenting the certificate (i.e. a webserver).
2. Information about the entity it represents (e.g., domain name, organization, etc.).
3. Optionally a signature by a certificate authority (CA) to verify its authenticity.

TLS certificates fall into two main categories:

1. CA certificates (which can issue other certificates)

- Root CA certificate (trusted by browsers)
- Intermediate CA certificates (subordinate CA certificates)
- (See also: [Chains of Trust - Let's Encrypt](https://letsencrypt.org/certificates))

1. End-entity certificates (aka “leaf cert”, cannot issue other certificates below it)

Formats and encoding for TLS certificates and keys:

- [PEM format](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail)
  - Base64 encoded data, enclosed between `-----BEGIN ...-----` and `-----END ...-----` lines.
  - The most common format to store certificates, signing requests and keys. Defined in [RFC 7468](https://datatracker.ietf.org/doc/html/rfc7468). More flexible alternative to the binary [DER format](https://en.wikipedia.org/wiki/X.690#DER_encoding).

- [X.509](https://en.wikipedia.org/wiki/X.509): A standard that defines the format of public key certificates.

# Private and Public Keys

Let’s start with private and public keys.

```auto
# Create private key, 4096-bit RSA or ed25519
openssl genrsa -out key.pem 4096
openssl genpkey -algorithm ed25519 -out key.pem

# Inspect private key details
openssl pkey -in key.pem -noout -text

# Show the public key of a private key in key.pem
openssl pkey -in key.pem -pubout

# Get sha256+base64 fingerprint (as needed for `curl --pinnedpubkey`)
openssl pkey -in key.pem -pubout -outform DER |
	openssl dgst -sha256 -binary |
	openssl enc -base64

```

## TLS Certificates and Certificate Signing Request (CSRs)[#](https://www.metachris.com/2025/09/tls-certificate-cheat-sheet-openssl-curl/#tls-certificates-and-certificate-signing-request-csrs)

Let’s create and examine TLS certificates and CSRs.

```auto
# Create TLS cert
openssl req -noenc -x509 -key key.pem -out cert.pem -sha256 -days 365 -subj "/O=YourOrg/CN=_DOMAIN_"

# Create CSR from cert
openssl x509 -x509toreq -signkey key.pem -in cert.pem -out csr.pem

# Create a CSR directly instead of from a cert
openssl req -new -key key.pem -subj "/O=YourOrg/CN=_DOMAIN_" -out csr.pem

# Show cert details
openssl x509 -in cert.pem -text -noout

# Show CSR details
openssl req -in csr.pem -text -noout

# Get key sha256+base64 fingerprint from cert
openssl x509 -in cert.pem -pubkey -noout |
	openssl pkey -pubin -outform der |
	openssl dgst -sha256 -binary |
	openssl enc -base64

# If you want to add extension fields (e.g., subjectAltName) to a CSR or cert, you can either do it with -addext, or
# using a config file. Here's an example creating a TLS cert with -addext for subjectAltName:
openssl req -noenc -x509 -key key.pem -out cert.pem -sha256 -days 365 -subj "/O=YourOrg/CN=_DOMAIN_" -addext subjectAltName=IP:192.168.100.82

```

# CA Certificates

Now let’s dive into CA certificates. We will create a root CA cert, an intermediate CA cert, and an end-entity cert signed by the root CA.

```bash
# Create private key for CA and intermediate CA
openssl genrsa -out ca.key 4096
openssl genrsa -out intermediate.key 4096

# Create CA certificate
openssl req -noenc -x509 -key ca.key -out ca-cert.pem -sha256 -days 365 -subj "/O=MyCA"

# Create intermediate CA certificate
openssl req -noenc -x509 -key intermediate.key -out intermediate-cert.pem -sha256 -days 365 -subj "/O=MyIntermediate"

# Create a CSR for intermediate CA
openssl x509 -x509toreq -signkey intermediate.key -in intermediate-cert.pem -out intermediate-csr.pem

# Sign intermediate CA with root CA
openssl x509 -req -in intermediate-csr.pem -CA ca-cert.pem -CAkey ca.key -CAcreateserial -out intermediate-cert-signed.pem -days 365 -sha256

# Verify intermediate CA is signed by root CA
openssl verify -CAfile ca-cert.pem intermediate-cert-signed.pem

# Show intermediate CA cert details
openssl x509 -in intermediate-cert-signed.pem -text -noout

# Create CSR (and key) for end-entity cert
openssl req -new -noenc -keyout key.pem -subj "/O=YourOrg/CN=_DOMAIN_" -out csr.pem

# Sign CSR with intermediate cert to create end-entity cert
openssl x509 -req -in csr.pem -CA intermediate-cert-signed.pem -CAkey intermediate.key -CAcreateserial -out cert.pem -days 365 -sha256

# Verify end-entity cert is signed by intermediate CA
openssl verify -CAfile intermediate-cert.pem cert.pem

# Combine CA cert and intermediate CA cert into a chain file
cat ca-cert.pem intermediate-cert-signed.pem > cert-chain.pem

# Verify end-entity cert is signed by root CA via intermediate CA
openssl verify -CAfile chain.pem cert.pem

```

# Curl Commands

```auto
# Save TLS cert from a server using curl
curl -w %{certs} -k https://_DOMAIN_ > server-cert.pem

# Require server to present a specific cert (using curl)
curl --cacert server-cert.pem https://_DOMAIN_

# Require server to present a specific key (using curl)
curl --pinnedpubkey "sha256//_PUBKEY_BASE64_FINGERPRINT_" https://_DOMAIN_

```

# Documentation and References

Documentation:

- [How to setup your own CA with OpenSSL](https://gist.github.com/soarez/9688998)
- [How Certificate Chains Work](https://knowledge.digicert.com/solution/how-certificate-chains-work)
- [https://sslinsights.com/what-are-digital-signatures-in-ssl-tls/](https://sslinsights.com/what-are-digital-signatures-in-ssl-tls/)
- PEM (Privacy-Enhanced Mail) Format: [Privacy-Enhanced Mail - Wikipedia](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail)
- X.509: [X.509 - Wikipedia](https://en.wikipedia.org/wiki/X.509)
- TLS 1.3
  - [Transport Layer Security - Wikipedia](https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3)
  - [The Transport Layer Security (TLS) Protocol Version 1.3](https://datatracker.ietf.org/doc/html/rfc8446)

- Certificate Authority Authorization (CAA)
  - [Certificate Authority Authorization (CAA) - Let's Encrypt](https://letsencrypt.org/docs/caa/)
  - [What Is a CAA Record? - DNSimple Help](https://support.dnsimple.com/articles/caa-record/)
  - [DNS Certification Authority Authorization - Wikipedia](https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization)

- [Certificate Transparency](https://en.wikipedia.org/wiki/Certificate_Transparency)

Tools:

- [https://certlogik.com/decoder](https://certlogik.com/decoder/#decoder-results)
- [SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/index.html)
- Our favorite acme client: [acme.sh](https://github.com/acmesh-official/acme.sh)