---
name: "ssl"
section: "8"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/ssl/8"
---

# ssl(8)

details for libssl and libcrypto

## NAME

**ssl** – details for libssl and libcrypto

## DESCRIPTION

This document describes some of the issues relating to the use of the OpenSSL libssl and libcrypto libraries. This document is intended as an overview of what the libraries do, and what uses them.

The libssl and libcrypto libraries implement the TLS version 1 protocol. It is most commonly used by the HTTPS protocol for encrypted web transactions, as can be done with [httpd(8)](/httpd/8.md). The libcrypto library is also used by various programs such as [ssh(1)](/ssh/1.md), [sshd(8)](/sshd/8.md), and [isakmpd(8)](/isakmpd/8.md).

## SERVER CERTIFICATES

The most common uses of TLS will require you to generate a server certificate, which is provided by your host as evidence of its identity when clients make new connections. The certificates reside in the */etc/ssl* directory, with the keys in the */etc/ssl/private* directory.

Private keys can be encrypted using AES and a passphrase to protect their integrity should the encrypted file be disclosed. However, it is important to note that encrypted server keys mean that the passphrase needs to be typed in every time the server is started. If a passphrase is not used, you will need to be absolutely sure your key file is kept secure.

## GENERATING RSA SERVER CERTIFICATES FOR WEB SERVERS

To support HTTPS transactions in [httpd(8)](/httpd/8.md) you will need to generate an RSA certificate. Start by creating a private key of the desired length:

```
# openssl genrsa -out /etc/ssl/private/server.key 4096
```

Or, if you wish the key to be encrypted with a passphrase that you will have to type in when starting servers

```
# openssl genrsa -aes256 -out /etc/ssl/private/server.key 4096
```

If you are only generating a private key to use with [acme-client(1)](/acme-client/1.md) (for example, with a non-default key length) you may stop here.

Otherwise, the next step is to generate a Certificate Signing Request (CSR) which is used to get a Certificate Authority (CA) to sign your certificate. To do this use the command:

```
# openssl req -new -key /etc/ssl/private/server.key \
  -out /etc/ssl/private/server.csr
```

This *server.csr* file can then be given to a Certificate Authority who will sign the key.

You can also sign the key yourself, using the command:

```
# openssl x509 -sha256 -req -days 365 \
  -in /etc/ssl/private/server.csr \
  -signkey /etc/ssl/private/server.key \
  -out /etc/ssl/server.crt
```

Note that standard web browsers do not use the common name of a subject, but instead require that subject alt names are provided. This requires the use of *-extfile* *server.ext* when self-signing.

```
# this is an example server.ext file
subjectAltName=DNS:example.com,DNS:www.example.com
```

With */etc/ssl/server.crt* and */etc/ssl/private/server.key* in place, you should be able to start [httpd(8)](/httpd/8.md) with SSL configured, enabling HTTPS transactions with your machine on port 443.

You will most likely want to generate a self-signed certificate in the manner above along with your certificate signing request to test your server's functionality even if you are going to have the certificate signed by another Certificate Authority. Once your Certificate Authority returns the signed certificate to you, you can switch to using the new certificate by replacing the self-signed */etc/ssl/server.crt* with the certificate signed by your Certificate Authority, and then restarting [httpd(8)](/httpd/8.md).

## GENERATING ECDSA SERVER CERTIFICATES

First, generate a private ECDSA key. The following command will use a NIST/SECG curve over a 384-bit prime field:

```
# openssl ecparam -name secp384r1 -genkey \
  -noout -out /etc/ssl/private/eccert.key
```

Note that some Certificate Authorities will only issue certificates for keys generated using prime256v1 parameters.

If you are only generating a private key to use with [acme-client(1)](/acme-client/1.md), you may stop here. Otherwise, the next step is to generate a Certificate Signing Request (CSR) which is used to get a Certificate Authority (CA) to sign your certificate. To do this use the command:

```
# openssl req -key /etc/ssl/private/eccert.key -new \
  -out /etc/ssl/private/eccert.csr
```

This *eccert.csr* file can then be given to a CA who will sign the key.

You can also sign the key yourself, using the command:

```
# openssl x509 -sha256 -req -days 365 \
  -in /etc/ssl/private/eccert.csr \
  -signkey /etc/ssl/private/eccert.key \
  -out /etc/ssl/eccert.crt
```

## SEE ALSO

[acme-client(1)](/acme-client/1.md), [openssl(1)](/openssl/1.md), [ssh(1)](/ssh/1.md), [ssl(3)](/ssl/3.md), [httpd(8)](/httpd/8.md), [isakmpd(8)](/isakmpd/8.md), [rc(8)](/rc/8.md), [smtpd(8)](/smtpd/8.md), [sshd(8)](/sshd/8.md), [starttls(8)](/starttls/8.md)