This page is a scrubbed, public-safe version of an internal AI/SI operations runbook — the
command cheat-sheet a systems engineer builds up over years of running Linux servers,
virtualisation hosts, firewalls, databases, certificates and Raspberry Pi devices.
It is organised into the same sections as the original workbook, one page each — reach any of
them from the AI/SI Prompts menu above. Every
task on this page shows three things:
A description — what the task achieves and which tools it uses.
The commands — the actual snippet, exactly as recorded, with every
credential, token, licence key and internal host name or IP replaced by a
<PLACEHOLDER>.
An AI prompt — a ready-to-paste instruction that asks an AI assistant to
regenerate that snippet as a clean, parameterised, re-runnable script.
The point of the AI-prompt column is to show how a pile of accumulated tribal knowledge can
be turned into something an assistant can reproduce and improve on demand: you keep the intent,
and let the model rewrite the mechanics for whatever host you are on today. Nothing on this
page should be run without reading it first — several snippets are destructive
(dd, rm -rf, postsuper -d ALL, firewall reloads).
Cert to PEM
Converts a DER certificate to PEM, and extracts certificates (and keys) from a PKCS#12 file.
Commands
openssl x509 -in aps_development.cer -inform DER -out aps_development.pem -outform PEM
# P12 to cert
openssl pkcs12 -in aps_development.p12 -out certificate.cer -nodes
# Linux p12 to pem
openssl pkcs12 -in aps_development.p12 -out aps_development.pem -nodes -clcerts
AI prompt
Generate an openssl command sequence for the task “Cert to PEM”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
View Certificates
Uses openssl s_client to connect to a TLS service and print the certificate chain it presents, optionally piping into openssl x509 for full details.
Generate an openssl command sequence for the task “View Certificates”. Take host and port (default 443) plus optional SNI name, run openssl s_client -connect host:port -servername name </dev/null, and pipe to openssl x509 -noout -text. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Certificate format conversion
Prints every certificate in a PEM bundle with openssl crl2pkcs7 and openssl pkcs7 -print_certs.
Generate an openssl command sequence for the task “Certificate format conversion”. Take a PEM bundle path; print the subject, issuer and validity dates of each certificate in order using openssl crl2pkcs7 -nocrl piped to openssl pkcs7 -print_certs, and flag any certificate that has expired. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Convert a PEM certificate file and a private key to PKCS#12 (.pfx .p12)
Converts certificates and keys between PEM, DER and PKCS#12 (.p12/.pfx) formats with openssl, including bundling an intermediate chain.
Generate an openssl command sequence for the task “Convert a PEM certificate file and a private key to PKCS#12 (.pfx .p12)”. Take input cert, key and optional chain file plus the target format; emit the right openssl x509 / openssl pkcs12 -export command and note when a passphrase is required. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Get an Apple iOS cert first
Steps to export an Apple Push (APNs) certificate and private key from Keychain Access as a .p12 and import it on Windows for a .NET app.
Commands
# Get an Apple Push cert
To get a p12 file, go to KeychainAccess and select the Apple Development Push Services: xxx
Select both the certificate and the private key (by opening the triangle to the left of the cert name)
Copy p12 to Windows and import into Personal and Trusted Root Certification Authorities stores.
Now use Visual Studio to read the .cer file from Apple (remember the password needs to be placed in the app for the cert to open properly).
AI prompt
Generate a step-by-step runbook for the task “Get an Apple iOS cert first”. Turn the checklist into an ordered runbook: export from Keychain (cert + key), convert to PKCS#12, import into the Windows stores, and load the .cer with its passphrase. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.
Keystore for FusionAuth
Builds a Java keystore for FusionAuth: exports the certificate and key to PKCS#12, then imports it into a JKS keystore with keytool.
Commands
Ensure the passwords you use are all the same
openssl pkcs12 -export -in /home/<USER>/ssl.cert -inkey /home/<USER>/ssl.key -out ssl.p12
/usr/local/fusionauth/java/current/bin/keytool -importkeystore -srckeystore ssl.p12 -srcstoretype PKCS12 -destkeystore keystore -deststoretype JKS
AI prompt
Generate an openssl command sequence for the task “Keystore for FusionAuth”. Parameterise the cert, key, keystore path and keytool location; export to PKCS#12 with openssl pkcs12 -export, import it with keytool -importkeystore, use the same password for both stores, and list the keystore contents to confirm. Assume CentOS/RHEL or Raspberry Pi OS as appropriate, comment each step, and never hard-code a real credential — read secrets from the environment.