{"id":7054,"date":"2023-11-15T21:55:43","date_gmt":"2023-11-16T04:55:43","guid":{"rendered":"https:\/\/ioflood.com\/blog\/?p=7054"},"modified":"2023-11-15T21:56:14","modified_gmt":"2023-11-16T04:56:14","slug":"openssl-view-certificate","status":"publish","type":"post","link":"https:\/\/ioflood.com\/blog\/openssl-view-certificate\/","title":{"rendered":"Viewing Certificates with OpenSSL: Step-by-Step Guide"},"content":{"rendered":"
\n
\"detailed<\/figure>\n<\/div>\n

Ever found yourself struggling to view SSL\/TLS certificates using OpenSSL? You’re not alone. Many developers find it challenging to decipher the details of a certificate, but there’s a tool that can make this process straightforward.<\/p>\n

Think of OpenSSL as a magnifying glass, allowing you to examine the intricate details of a certificate. It’s a powerful utility that can help you understand the ins and outs of SSL\/TLS certificates.<\/p>\n

This guide will walk you through the process of viewing certificates using OpenSSL<\/strong>, from basic usage to advanced techniques. We’ll cover everything from executing simple commands to viewing specific details of the certificate and even troubleshooting common issues.<\/p>\n

So, let’s dive in and start mastering OpenSSL!<\/p>\n

TL;DR: How Do I View a Certificate Using OpenSSL?<\/h2>\n

\n To view a certificate using OpenSSL, you use the openssl x509 -in [certificate.crt] -text -noout<\/code> command. This command allows you to view the details of a certificate stored in a file named certificate.crt<\/code>.\n<\/p><\/blockquote>\n

Here’s a simple example:<\/p>\n

openssl x509 -in example.crt -text -noout\n\n# Output:\n# Certificate:\n#     Data:\n#         Version: 3 (0x2)\n#         Serial Number:\n#             11:21:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00\n#         Signature Algorithm: sha256WithRSAEncryption\n#         Issuer: C = US, ST = California, L = Mountain View, O = Google LLC, CN = Google Internet Authority G3\n#         Validity\n#             Not Before: Apr  2 09:33:27 2019 GMT\n#             Not After : Jun 25 09:33:27 2019 GMT\n#         Subject: C = US, ST = California, L = Mountain View, O = Google LLC, CN = *.google.com\n#         Subject Public Key Info:\n#             Public Key Algorithm: id-ecPublicKey\n#                 Public-Key: (256 bit)\n#                 pub:\n#                     04:01:02:03:04:05:06:07:08:09:0a:0b:0c:0d:0e:0f:\n#                     10:11:12:13:14:15:16:17:18:19:1a:1b:1c:1d:1e:1f:\n#                     20:21:22:23:24:25:26:27:28:29:2a:2b:2c:2d:2e:2f:\n#                     30:31:32:33:34:35:36:37:38:39:3a:3b:3c:3d:3e:3f\n#                 ASN1 OID: prime256v1\n#                 NIST CURVE: P-256\n#         X509v3 extensions:\n#             X509v3 Key Usage: critical\n#                 Digital Signature\n#             X509v3 Extended Key Usage: \n#                 TLS Web Server Authentication\n#             X509v3 Basic Constraints: critical\n#                 CA:FALSE\n#             X509v3 Subject Key Identifier: \n#                 BB:CE:F0:E2:36:3B:2A:02:00:88:1D:44:37:DC:76:FE\n#             X509v3 Authority Key Identifier: \n#                 keyid:77:77:CE:03:4E:9B:26:67:29:4A:40:10:3A:1D:56:FA:25:9F:75:8C\n\n#             Authority Information Access: \n#                 OCSP - URI:http:\/\/ocsp.pki.goog\/gts1o1core\n#                 CA Issuers - URI:http:\/\/pki.goog\/gsr2\/GTS1O1.crt\n\n#             X509v3 Subject Alternative Name: \n#                 DNS:*.google.com, DNS:*.android.com, DNS:*.appengine.google.com, DNS:*.cloud.google.com, DNS:*.crowdsource.google.com, DNS:*.g.co, DNS:*.gcp.gvt2.com, DNS:*.gcpcdn.gvt1.com, DNS:*.ggpht.cn, DNS:*.gkecnapps.cn, DNS:*.google-analytics.com, DNS:*.google.ca, DNS:*.google.cl, DNS:*.google.co.in, DNS:*.google.co.jp, DNS:*.google.co.uk, DNS:*.google.com.ar, DNS:*.google.com.au, DNS:*.google.com.br, DNS:*.google.com.co, DNS:*.google.com.mx, DNS:*.google.com.tr, DNS:*.google.com.vn, DNS:*.google.de, DNS:*.google.es, DNS:*.google.fr, DNS:*.google.hu, DNS:*.google.it, DNS:*.google.nl, DNS:*.google.pl, DNS:*.google.pt, DNS:*.googleadapis.com, DNS:*.googleapis.cn, DNS:*.googlecnapps.cn, DNS:*.googlecommerce.com, DNS:*.googlevideo.com, DNS:*.gstatic.cn, DNS:*.gstatic.com, DNS:*.gstaticcnapps.cn, DNS:*.gvt1.com, DNS:*.gvt2.com, DNS:*.metric.gstatic.com, DNS:*.urchin.com, DNS:*.url.google.com, DNS:*.youtube-nocookie.com, DNS:*.youtube.com, DNS:*.youtubeeducation.com, DNS:*.youtubekids.com, DNS:*.yt.be, DNS:*.ytimg.com, DNS:android.clients.google.com, DNS:android.com, DNS:developer.android.google.cn, DNS:developers.android.google.cn, DNS:g.co, DNS:ggpht.cn, DNS:goo.gl, DNS:google-analytics.com, DNS:google.com, DNS:googlecnapps.cn, DNS:googlecommerce.com, DNS:source.android.google.cn, DNS:urchin.com, DNS:www.goo.gl, DNS:youtu.be, DNS:youtube.com, DNS:youtubeeducation.com, DNS:youtubekids.com, DNS:yt.be\n#             X509v3 Certificate Policies: \n#                 Policy: 1 : 2.23.140.1.2.2\n#                 Policy: 2.23.140.1.2.1\n#                 User Notice:\n#                   Explicit Text: This Certificate may only be relied upon by Relying Parties and only in accordance with the Certificate Policy found at https:\/\/pki.goog\/repo\/cps\n\n#     Signature Algorithm: sha256WithRSAEncryption\n#          11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:\n#          55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88\n<\/code><\/pre>\n
In this example, we’ve used the openssl x509 -in example.crt -text -noout<\/code> command to view the details of a certificate stored in a file named example.crt<\/code>. The output provides a wealth of information about the certificate, including its version, serial number, signature algorithm, issuer, validity period, subject, subject public key info, and various X509v3 extensions.<\/p>\n
\n  This is just a basic way to view a certificate using OpenSSL. There’s much more to learn about OpenSSL’s capabilities, including advanced usage scenarios and troubleshooting techniques. Continue reading for more detailed information.\n<\/p><\/blockquote>\n
View a Certificate: Beginner’s Guide<\/h2>\n
Let’s start with the basics. To view a certificate using OpenSSL, you’ll need to use the openssl x509 -in [certificate.crt] -text -noout<\/code> command. This command allows you to view the details of a certificate stored in a file named certificate.crt<\/code>. Let’s break it down:<\/p>\n
    \n
  • openssl<\/code>: This is the command line tool for OpenSSL, a robust, full-featured open-source toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols.<\/p>\n<\/li>\n
  • \n
    x509<\/code>: This flag tells OpenSSL to output the certificate in X.509 format, which is a widely used standard for defining digital certificates.<\/p>\n<\/li>\n
  • \n
    -in [certificate.crt]<\/code>: This option specifies the input filename to read a certificate from or standard input if this option is not specified. Replace [certificate.crt]<\/code> with the path to your certificate file.<\/p>\n<\/li>\n
  • \n
    -text<\/code>: This option tells OpenSSL to print out the certificate in text form.<\/p>\n<\/li>\n
  • \n
    -noout<\/code>: This option prevents the encoded version of the certificate (i.e., the certificate itself) from being output.<\/p>\n<\/li>\n<\/ul>\n
    Here’s a simple example:<\/p>\n
    openssl x509 -in \/etc\/ssl\/certs\/ssl-cert-snakeoil.pem -text -noout\n\n# Output:\n# Certificate:\n#     Data:\n#         Version: 1 (0x0)\n#         Serial Number:\n#             9e:b9:c0:c5:9c:08:38:cd:4a:4e:0c:56:58:76:10:90:1b:75:77:2f\n#         Signature Algorithm: sha256WithRSAEncryption\n#         Issuer: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd\n#         Validity\n#             Not Before: Apr  8 14:02:16 2021 GMT\n#             Not After : Apr  6 14:02:16 2031 GMT\n#         Subject: C = AU, ST = Some-State, O = Internet Widgits Pty Ltd\n#         Subject Public Key Info:\n#             Public Key Algorithm: rsaEncryption\n#                 RSA Public-Key: (2048 bit)\n#                 Modulus:\n#                     00:c2:04:ec:...\n#                 Exponent: 65537 (0x10001)\n#     Signature Algorithm: sha256WithRSAEncryption\n#          2f:7c:6a:13:...\n<\/code><\/pre>\n
    In this example, we’re using the openssl x509 -in \/etc\/ssl\/certs\/ssl-cert-snakeoil.pem -text -noout<\/code> command to view the details of a certificate stored in a file named ssl-cert-snakeoil.pem<\/code>. The output provides a wealth of information about the certificate, including its version, serial number, signature algorithm, issuer, validity period, subject, and subject public key info.<\/p>\n
    As you can see, OpenSSL provides a wealth of information about a certificate with just a single command. Understanding this output is key to working effectively with SSL\/TLS certificates.<\/p>\n
    Viewing Specific Certificate Details with OpenSSL<\/h2>\n
    While the basic command gives you a comprehensive view of the certificate, OpenSSL also allows you to extract specific details from the certificate. This can be especially useful when you’re interested in a particular aspect of the certificate, such as its issuer or its subject.<\/p>\n
    To extract specific details from a certificate, you can use the -nameopt<\/code> option followed by the specific detail you want to extract. For example, to extract the issuer of the certificate, you can use the following command:<\/p>\n
    openssl x509 -in \/etc\/ssl\/certs\/ssl-cert-snakeoil.pem -noout -issuer\n\n# Output:\n# issuer=C = AU, ST = Some-State, O = Internet Widgits Pty Ltd\n<\/code><\/pre>\n
    In this example, the -issuer<\/code> option is used to print the issuer of the certificate. The output shows the issuer of the certificate, which is ‘Internet Widgits Pty Ltd’.<\/p>\n
    Similarly, to extract the subject of the certificate, you can use the -subject<\/code> option as follows:<\/p>\n
    openssl x509 -in \/etc\/ssl\/certs\/ssl-cert-snakeoil.pem -noout -subject\n\n# Output:\n# subject=C = AU, ST = Some-State, O = Internet Widgits Pty Ltd\n<\/code><\/pre>\n
    In this example, the -subject<\/code> option is used to print the subject of the certificate. The output shows the subject of the certificate, which is also ‘Internet Widgits Pty Ltd’.<\/p>\n
    As you can see, OpenSSL allows you to extract specific details from a certificate with ease. With a deeper understanding of these commands, you can quickly get the information you need without having to sift through the entire certificate.<\/p>\n
    Exploring Other Ways to View Certificates<\/h2>\n
    While OpenSSL is a powerful tool for viewing certificates, it’s not the only one available. There are other commands and tools that can also be used to view certificates. Let’s explore some of these alternatives.<\/p>\n
    Using the openssl s_client<\/code> Command<\/h3>\n
    The openssl s_client<\/code> command is a utility for testing SSL and TLS connections. It can also be used to view the certificate of a remote server. Here’s how you can use it:<\/p>\n
    echo | openssl s_client -servername hostname -connect host:port 2>\/dev\/null | openssl x509 -text\n\n# Output:\n# Certificate:\n#     Data:\n#         Version: 3 (0x2)\n#         Serial Number:\n#             04:e1:e7:a4:dc:5c:f2:0c:3b:0d:47:34:1a:56:5b:7a:1b:56:4d:68\n#         Signature Algorithm: sha256WithRSAEncryption\n#         Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = RapidSSL RSA CA 2018\n#         Validity\n#             Not Before: Mar  1 00:00:00 2020 GMT\n#             Not After : Apr  1 12:00:00 2022 GMT\n#         Subject: CN = *.example.com\n#         Subject Public Key Info:\n#             Public Key Algorithm: rsaEncryption\n#                 RSA Public-Key: (2048 bit)\n#                 Modulus:\n#                     00:c4:5a:...\n#                 Exponent: 65537 (0x10001)\n#     Signature Algorithm: sha256WithRSAEncryption\n#          4c:7e:7c:...\n<\/code><\/pre>\n
    In this example, we’re using the openssl s_client<\/code> command to connect to a remote server and retrieve its certificate. The -connect host:port<\/code> option specifies the host and port to connect to, while the -servername hostname<\/code> option sets the TLS SNI (Server Name Indication) extension to the specified hostname. The output of this command is then piped to openssl x509 -text<\/code> to view the certificate details.<\/p>\n
    Using the keytool<\/code> Command<\/h3>\n
    If you’re working with Java applications, you might find the keytool<\/code> command more convenient. keytool<\/code> is a key and certificate management utility that allows users to administer their own public\/private key pairs and associated certificates for use in self-authentication. Here’s how you can use it to view a certificate:<\/p>\n
    keytool -printcert -file mydomain.crt\n\n# Output:\n# Owner: CN=www.example.com, OU=IT, O=Example, L=San Francisco, ST=California, C=US\n# Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US\n# Serial number: 3e2097f4b8d5aef4a05f5f8e36c0b9d5d3e\n# Valid from: Wed Sep 30 14:35:39 UTC 2020 until: Tue Dec 29 14:35:39 UTC 2020\n# Certificate fingerprints:\n#  SHA1: D2:CA:1F:8B:8E:ED:77:2F:9D:15:50:58:BC:2F:32:26:75:6C:40:7A\n#  SHA256: 69:5D:56:2B:7F:5D:39:B0:82:91:1C:F9:C5:6A:DB:6D:2F:E6:2D:91:36:7A:6F:28:11:30:BB:B3:73:FA:FA:5D\n# Signature algorithm name: SHA256withRSA\n# Subject Public Key Algorithm: 2048-bit RSA key\n# Version: 3\n\n<\/code><\/pre>\n
    In this example, we’re using the keytool -printcert -file mydomain.crt<\/code> command to view the details of a certificate stored in a file named mydomain.crt<\/code>. The output provides a wealth of information about the certificate, including its owner, issuer, serial number, validity period, certificate fingerprints, signature algorithm name, subject public key algorithm, and version.<\/p>\n
    As you can see, there are several ways to view certificates. Depending on your specific needs and the tools you’re comfortable with, you might find one method more convenient than the others.<\/p>\n
    Navigating Common OpenSSL Pitfalls<\/h2>\n
    While OpenSSL is a powerful tool, it’s not without its quirks. Here are some common errors you may encounter when using OpenSSL to view certificates, along with their solutions and some tips for best practices and optimization.<\/p>\n
    Unable to Load Certificate<\/h3>\n
    One of the most common errors you may encounter is the ‘unable to load certificate’ error. This usually happens when the certificate file you’re trying to view doesn’t exist or can’t be accessed.<\/p>\n
    openssl x509 -in non_existent_file.crt -text -noout\n\n# Output:\n# unable to load certificate\n# 140735207381464:error:02001002:system library:fopen:No such file or directory:bss_file.c:402:fopen('non_existent_file.crt','r')\n# 140735207381464:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:404:\n<\/code><\/pre>\n
    In this example, we’re trying to view a certificate stored in a file named non_existent_file.crt<\/code>, which doesn’t exist. As a result, OpenSSL throws an ‘unable to load certificate’ error.<\/p>\n
    To resolve this issue, make sure the certificate file you’re trying to view exists and can be accessed. Check the file path and permissions.<\/p>\n
    Invalid Certificate Format<\/h3>\n
    Another common error is the ‘invalid certificate format’ error. This usually happens when the certificate file you’re trying to view isn’t in the expected PEM format.<\/p>\n
    openssl x509 -in invalid_format.crt -text -noout\n\n# Output:\n# unable to load certificate\n# 140735207381464:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: TRUSTED CERTIFICATE\n<\/code><\/pre>\n
    In this example, we’re trying to view a certificate stored in a file named invalid_format.crt<\/code>, which isn’t in the expected PEM format. As a result, OpenSSL throws an ‘invalid certificate format’ error.<\/p>\n
    To resolve this issue, make sure the certificate file you’re trying to view is in the expected PEM format. If it’s in a different format, you may need to convert it to PEM format first.<\/p>\n
    Best Practices and Optimization<\/h3>\n
    When using OpenSSL to view certificates, here are some tips for best practices and optimization:<\/p>\n