Deepak Prasad

Prefer a custom PKCS12 truststore over editing JDK cacerts: isolate private CA trust per app, survive package upgrades, and set javax.net.ssl.trustStore without touching the global Java CA bundle.

keytool is the Java CLI for keystores and truststores: generate key pairs, build CSRs, import CA-signed certificates and PKCS12 bundles, list aliases, export PEM certs, and manage passwords. This cheat sheet covers …

Fix keytool command not found on Ubuntu by installing OpenJDK (default-jdk or openjdk-21-jdk), set JAVA_HOME and PATH, verify with keytool -help, run a PKCS12 smoke test, update through apt, and uninstall cleanly.

Compare OpenSSL, LibreSSL, and BoringSSL for TLS and cryptography: intended audience, API stability, FIPS, how Linux distributions package each library, and when each is the right choice—with commands to verify what your …

OpenSSL is the standard CLI for TLS keys, X.509 certificates, CSRs, chain verification, PKCS#12 bundles, file encryption, and live HTTPS inspection. This cheat sheet covers everyday subcommands with copy-paste tables and …

Beginner-friendly PKI tutorial: public keys, X.509 certificates, Certificate Authorities, trust chains, SAN extensions, PEM and PFX formats, CRL vs OCSP revocation, TLS and mTLS handshakes—with diagrams and OpenSSL …

Create a PKCS12 (.p12) keystore from CRT and KEY with OpenSSL pkcs12 -export for Java keytool, Oracle JSSE, and IBM apps. Covers alias, chain, self-signed certs, -legacy for older Java, cert-only bundles, and …

Create a PFX or P12 file from CRT and KEY with OpenSSL pkcs12 -export: add intermediate chain with -certfile, set export password with -passout, and use -legacy for Windows IIS. Copy-paste examples with verification …

Use OpenSSL pkcs12 to extract a private key, certificate, and CA chain from a PFX or P12 file on Linux. Covers password-protected and empty-password PFX, unencrypted PEM for nginx, -legacy for old Windows exports, and …

Verify a certificate matches a private key with OpenSSL: compare RSA modulus MD5 hashes, use pkey -pubout for EC and ECDSA, check CSR alignment, and test encrypted keys. Covers nginx mismatch errors and copy-paste …

Find where OpenSSL keeps openssl.cnf, trust-store certificates, libssl libraries, and the openssl binary on Linux and Windows. Use openssl version -d, which openssl, ldconfig, and OPENSSL_CONF when paths differ between …

Install OpenSSL on Ubuntu with apt (openssl and libssl-dev), verify with openssl version, understand when the distro package is enough versus building from source, and generate a test TLS key and certificate.

Generate a self-signed SSL certificate with OpenSSL in one command or via CSR: RSA 2048/4096, EC, Ed25519, SAN for localhost and IP addresses, encrypted keys, and nginx-ready PEM files. Copy-paste examples with real …

APT on Debian and Ubuntu does not offer a single yum-style history undo. This page covers reading /var/log/apt/history.log, downgrading with apt install package=version, holding packages, and when to use snapshots …

lsblk lists block devices — disks, partitions, LVM volumes, and loop devices — in a tree with sizes and mount points. Use it before partitioning, mounting, or resizing storage when you need a quick map of what lives on …

systemctl is the main control tool for systemd on modern Linux. It lists units, shows service status, reads unit files, and starts or stops daemons — the first command to reach for when a service misbehaves or you need …

ufw (Uncomplicated Firewall) is the default host firewall front end on Ubuntu and Debian. It wraps iptables/nftables with simple allow, deny, and limit rules for ports, subnets, and applications.

On RHEL, Rocky Linux, AlmaLinux, and Fedora, firewalld manages host firewall rules through zones and services. The firewall-cmd CLI opens ports, assigns interfaces to zones, and applies rich rules without restarting the …

On Arch Linux and derivatives, pacman is the native package manager. It syncs official repositories, installs and removes packages with dependency tracking, and maintains a local package database under /var/lib/pacman/.

sysctl reads and writes Linux kernel tunables under /proc/sys. Use sysctl -w for temporary changes, drop files in /etc/sysctl.d/, then sysctl -p or sysctl --system to reload without rebooting — except for parameters that …

On RHEL, Fedora, and related RPM distros, yum and dnf record each install, update, and remove in a SQLite history. Use history list, info, undo, redo, and rollback to reverse transactions — not a substitute for backups …

On RHEL, Rocky Linux, AlmaLinux, and Fedora, grubby is a command-line tool for listing and editing GRUB2 boot entries. It changes default kernels and kernel arguments without hand-editing grub.cfg or running …

Walk a directory tree with grep -r or -R, narrow results with --include and --exclude-dir, and list matching files with -l, -L, and --null. This page covers recursive tree search only — not regex engines or pattern …

SFTP transfers files over SSH. This page covers non-interactive one-liners — URL-style paths, batch files (-b), here-documents, and sshpass patterns — for scripts and cron jobs, not an interactive SFTP shell tutorial.

On RHEL and CentOS, lsyncd watches local directories with inotify and triggers rsync (or rsync over SSH) to mirror changes to another path or host. It is a lightweight live-sync daemon for slowly changing trees.

mount attaches a filesystem (block device, loop file, NFS export, or ISO image) to a directory tree. umount detaches it. fstab lists mounts applied at boot with mount -a.

zip packages and compresses files into a .zip archive. unzip extracts them. Common tasks include recursive directory archives, exclusions, password protection, and listing contents without extracting.

The pssh package provides parallel-ssh, parallel-scp, parallel-slurp, parallel-nuke, and parallel-rsync — Python tools that fan out SSH, copy, and rsync jobs across many hosts from one control node using a host list file …

wget downloads files over HTTP, HTTPS, and FTP without a browser. It supports resume, retries, mirrors, batch URL lists, and quiet automation from scripts and cron jobs.

cat reads files or standard input and writes the bytes to standard output. Use it to view small text files, join files in order, or pipe stdin into a new file with shell redirection.