OPENSSL-REHASH(1SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

✨ NAME ✨

openssl-rehash, c_rehash — the lil tools that make symbolic links to files named by their hash values 🎀

okay so quick thing before we dive in: this whole page is from OPENSSL-REHASH(1SSL), bestie. that's the manual section we're living in. stay with me 💖

🌸 SYNOPSIS 🌸

openssl rehash [-h] [-help] [-old] [-compat] [-n] [-v] [-provider name]
[-provider-path path] [-provparam [name:]key=value] [-propquery propq]
[directory] ...

like. look at her. a whole command with a whole pile of flags and then just... directories. as many as u want. iconic.

🦋 DESCRIPTION 🦋

okay so here's the tea, fr fr 🍓

openssl rehash goes through directories and calculates a hash value for every single .pem, .crt, .cer, or .crl file in the directory list u gave it, and then it makes symbolic links for each file — where the name of the link is that hash value. chef's kiss. 💅

If ur platform doesn't support symbolic links, it just makes a copy instead. no drama.

and why do we even care??? because SO many programs that use OpenSSL literally require directories to be set up like this in order to FIND certificates. it's giving "the bouncer needs ur name on the list, bestie". 😭

so here's how the dirs get picked:

  • if u name directories on the command line, those get processed one after another, in turn. ✅
  • if u don't name any, then the SSL_CERT_DIR environment variable gets consulted. it should be a colon-separated list of directories (or semicolon-separated on Windows, iykyk), just like the PATH variable. 💫
  • and if that's not set either? then the default directory gets processed — it's installation-specific, but often it's /usr/local/ssl/certs. 🏠

one thing tho. for a directory to actually get processed, u gotta have write permissions on that directory. no write perms = an error gets generated. lowkey harsh but fair. 🙈

the links that get created look like this:

HHHHHHHH.D

where every single H is a hexadecimal character, and D is a single decimal digit. cute, organized, obsessed. 👑

important warning tho — when a directory gets processed, ALL links in it that have a name in that syntax get removed FIRST. even if they're being used for some totally other purpose. like... it does not care. it will simply delete them. 😭 so if u wanna skip that removal step, use the -n flag. (more on her in a sec.)

hashes for CRL's look super similar, except the letter r shows up after the period, like this:

HHHHHHHH.rD

multiple objects can have the SAME hash, and when that happens they get indicated by incrementing that D value. how are duplicates found? by comparing the full SHA-1 fingerprint. and if a duplicate is found, a warning gets displayed. 🚨

a warning ALSO gets displayed if there are files that can't be parsed as either a certificate or a CRL, or if more than one such object appears in the file. main character problems honestly. 💀

💖 OPTIONS 💖

  • -help, -h — displays a brief usage message. the "hi what is this" button. 🫶
  • -old — uses old-style hashing (MD5, as opposed to SHA-1) for generating links, the kind that were used for releases before 1.0.0. but heads up bestie: current versions will NOT use the old style. 👵
  • -n — does not remove existing links. this is literally needed when u wanna keep new and old-style links chillin' in the same directory. 🛑
  • -compat — generates links for BOTH old-style (MD5) AND new-style (SHA1) hashing. this lets releases before 1.0.0 use these links along-side newer releases. everybody eats. 🔥
  • -v — prints messages about old links removed and new links created. by default, this command only lists each directory as it gets processed. so -v is the yapper mode. 🗣️✨
  • -provider name, -provider-path path, -provparam [name:]key=value, -propquery propq — these ones? go read "Provider Options" in openssl(1), provider(7), and property(7). they're the provider girlies. 👑

🌈 ENVIRONMENT 🌈

  • OPENSSL — the path to an executable to use to generate hashes and fingerprints (see above). ⭐
  • PATH — list of paths, separated by colons (or semicolons, on Windows platforms), where the openssl executable is searched in case the path to the hash generating executable is not provided in the OPENSSL environment variable, or it is not usable — that is, it does not exist or is not executable. the backup plan of backup plans. 💪
  • SSL_CERT_DIR — list of directories to operate on. on Unix-like systems the list entries are separated by a colon. on Windows they are separated by a semicolon. Ignored if directories are listed on the command line. periodt. 🔇

👀 SEE ALSO 👀

openssl(1), openssl-crl(1), openssl-x509(1)

go read ur friends, bestie. they're all in the group chat. 💬

📜 HISTORY 📜

c_rehash was removed in OpenSSL 4.0. use openssl rehash instead. rip to a legend but she's gone, we move on. 🕊️

Copyright 2015-2026 The OpenSSL Project Authors. All Rights Reserved. 💖

Licensed under the Apache License 2.0 (the "License"). you may not use this file except in compliance with the License. you can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page bestie, from the 4.0.3 version dated 2026-09-29 — OPENSSL-REHASH(1SSL), written and shipped by the OpenSSL crew 🫶✨ tysm for reading, u ate that ngl 💅💜

📦 where this page comes from