# View and decode a certificate

To read a certificate, run `openssl x509 -in certificate.crt -noout -text`. The `-noout` flag suppresses the re-printed Base64 so you get only the human-readable decoding. For a single field, use a targeted flag instead of grepping the full dump — `-subject`, `-issuer`, `-dates`, `-serial` and `-fingerprint` each print one thing and are far easier to use in scripts. Add `-inform der` if the file is binary rather than PEM.

Source: https://certguru.io/openssl/view-certificate/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## The full dump

*Everything, decoded*

```bash
openssl x509 -in certificate.crt -noout -text
```

Expected output:

```
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:e1:9a:...
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = Example CA, CN = Example Intermediate CA
        Validity
            Not Before: Aug 16 00:00:00 2026 GMT
            Not After : Nov 14 23:59:59 2026 GMT
        Subject: CN = example.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:example.com, DNS:www.example.com
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
```

## One field at a time

Far better than grepping the dump, and stable enough to script against:

*Subject and issuer*

```bash
openssl x509 -in certificate.crt -noout -subject -issuer
```

Expected output:

```
subject=CN = example.com
issuer=C = US, O = Example CA, CN = Example Intermediate CA
```

*Validity window*

```bash
openssl x509 -in certificate.crt -noout -dates
```

Expected output:

```
notBefore=Aug 16 00:00:00 2026 GMT
notAfter=Nov 14 23:59:59 2026 GMT
```

*Subject alternative names only*

```bash
openssl x509 -in certificate.crt -noout -ext subjectAltName
```

Expected output:

```
X509v3 Subject Alternative Name:
    DNS:example.com, DNS:www.example.com
```

*Fingerprint*

```bash
openssl x509 -in certificate.crt -noout -fingerprint -sha256
```

*Serial number*

```bash
openssl x509 -in certificate.crt -noout -serial
```

## The flags worth remembering

| Flag | Prints |
| --- | --- |
| `-text` | Everything, decoded |
| `-subject` | Subject distinguished name |
| `-issuer` | Issuer distinguished name |
| `-dates` | `notBefore` and `notAfter` |
| `-enddate` | Expiry only |
| `-serial` | Serial number |
| `-fingerprint -sha256` | SHA-256 fingerprint |
| `-ext ` | One named extension |
| `-purpose` | What the certificate is permitted to be used for |
| `-pubkey` | The public key, PEM-encoded |
| `-noout` | Suppress the re-encoded certificate |

## Reading what matters

Three fields decide whether a certificate will work, and it is worth knowing what to look for:

*The three that break deployments*

```bash
openssl x509 -in certificate.crt -noout -ext subjectAltName -ext basicConstraints -dates
```

- **Subject Alternative Name** must list every hostname clients will use. Browsers ignore the Common
  Name entirely. Missing SANs is the most common reason a valid-looking certificate fails.
- **Basic Constraints** must read `CA:FALSE` for a server certificate. `CA:TRUE` means you have
  accidentally deployed a CA certificate.
- **Validity** — check both ends. A certificate whose `notBefore` is in the future fails just as
  hard as an expired one, and the error messages are less familiar.

## A DER file

```bash
openssl x509 -inform der -in certificate.der -noout -text
```

## Several certificates in one file

`openssl x509` reads only the first certificate in a file. For a chain, use `crl2pkcs7` as a
splitter:

*Subject and issuer of every certificate in a bundle*

```bash
openssl crl2pkcs7 -nocrl -certfile fullchain.crt | openssl pkcs7 -print_certs -noout
```

## Related

- [Check when a certificate expires](/openssl/check-certificate-expiry/)
- [Fetch a certificate from a live server](/openssl/get-certificate-from-server/)
- [Decode a certificate in your browser](/tools/decode-certificate/)


## Frequently asked questions

### What does -noout do?

It suppresses the encoded form of the certificate in the output. Without it, OpenSSL prints the full decoding and re-emits the Base64 block, which is rarely what you want on screen.

### How do I see just the SANs?

`openssl x509 -in certificate.crt -noout -ext subjectAltName`. The `-ext` flag takes any extension name and prints only that one, which is much cleaner than grepping the full text dump.

### Why does the command fail on my .cer file?

Almost certainly because the file is DER-encoded and OpenSSL defaulted to PEM. Add `-inform der`. See that error explained.

### How do I check a certificate on a live server rather than a file?

Pipe s_client into x509 — see fetch a certificate from a server.


## References

- [openssl-x509(1)](https://docs.openssl.org/3.5/man1/openssl-x509/) — every flag for reading a certificate
- [RFC 5280: X.509 and CRL profile](https://www.rfc-editor.org/rfc/rfc5280) — the specification every field on a certificate comes from

## Related pages

- https://certguru.io/openssl/check-certificate-expiry/
- https://certguru.io/openssl/get-certificate-from-server/
- https://certguru.io/openssl/view-csr/
- https://certguru.io/formats/pem/
- https://certguru.io/openssl/verify-certificate-chain/
- https://certguru.io/concepts/fingerprint/

--
CertGuru — https://certguru.io