OpenSSL and TLS notes: inspecting and verifying certificates, CSRs, private keys and keystores from the command line.
OpenSSL can decode a CSR so you can confirm the subject, SANs, and key size before sending it to a CA. Here's the one command to read it, plus how to verify a CSR matches the private key it was generated from.
OpenSSL reads X.509 certificates so you can check the subject, SANs, issuer, and expiry — and confirm a cert matches the private key it's paired with. Includes the s_client trick for inspecting what a live HTTPS server is really serving.
An encrypted private key makes Apache/nginx prompt for a passphrase on every start — a problem for unattended reboots. OpenSSL can write an unencrypted copy. Here's how, for RSA/EC/any key, plus why you should lock the file down and what the safer alternatives are.
Java's default truststore (cacerts) password is 'changeit' — and has been forever. Here's where the file lives in a modern JDK, plus the keytool commands to list trusted CAs, import a self-signed/internal certificate, and actually change that password.