CertGuru

View and decode a certificate

To read a certificate, run `openssl x509 -in certificate.crt -noout -text`. The `-noout` flag suppresses the re-printed Base64 so you get only the human-readable decoding. For a single field, use a targeted flag instead of grepping the full dump — `-subject`, `-issuer`, `-dates`, `-serial` and `-fingerprint` each print one thing and are far easier to use in scripts. Add `-inform der` if the file is binary rather than PEM.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

The full dump #

Everything, decoded
openssl x509 -in certificate.crt -noout -text
Expected output 
Certificate:
  Data:
      Version: 3 (0x2)
      Serial Number:
          04:e1:9a:...
      Signature Algorithm: sha256WithRSAEncryption
      Issuer: C = US, O = Example CA, CN = Example Intermediate CA
      Validity
          Not Before: Aug 16 00:00:00 2026 GMT
          Not After : Nov 14 23:59:59 2026 GMT
      Subject: CN = example.com
      Subject Public Key Info:
          Public Key Algorithm: rsaEncryption
              Public-Key: (2048 bit)
      X509v3 extensions:
          X509v3 Subject Alternative Name:
              DNS:example.com, DNS:www.example.com
          X509v3 Key Usage: critical
              Digital Signature, Key Encipherment
          X509v3 Extended Key Usage:
              TLS Web Server Authentication, TLS Web Client Authentication
          X509v3 Basic Constraints: critical
              CA:FALSE

One field at a time #

Far better than grepping the dump, and stable enough to script against:

Subject and issuer
openssl x509 -in certificate.crt -noout -subject -issuer
Expected output 
subject=CN = example.com
issuer=C = US, O = Example CA, CN = Example Intermediate CA
Validity window
openssl x509 -in certificate.crt -noout -dates
Expected output 
notBefore=Aug 16 00:00:00 2026 GMT
notAfter=Nov 14 23:59:59 2026 GMT
Subject alternative names only
openssl x509 -in certificate.crt -noout -ext subjectAltName
Expected output 
X509v3 Subject Alternative Name:
  DNS:example.com, DNS:www.example.com
Fingerprint
openssl x509 -in certificate.crt -noout -fingerprint -sha256
Serial number
openssl x509 -in certificate.crt -noout -serial

The flags worth remembering #

Flag Prints
-text Everything, decoded
-subject Subject distinguished name
-issuer Issuer distinguished name
-dates notBefore and notAfter
-enddate Expiry only
-serial Serial number
-fingerprint -sha256 SHA-256 fingerprint
-ext <name> One named extension
-purpose What the certificate is permitted to be used for
-pubkey The public key, PEM-encoded
-noout Suppress the re-encoded certificate

Reading what matters #

Three fields decide whether a certificate will work, and it is worth knowing what to look for:

The three that break deployments
openssl x509 -in certificate.crt -noout -ext subjectAltName -ext basicConstraints -dates
  • Subject Alternative Name must list every hostname clients will use. Browsers ignore the Common Name entirely. Missing SANs is the most common reason a valid-looking certificate fails.
  • Basic Constraints must read CA:FALSE for a server certificate. CA:TRUE means you have accidentally deployed a CA certificate.
  • Validity — check both ends. A certificate whose notBefore is in the future fails just as hard as an expired one, and the error messages are less familiar.

A DER file # 

openssl x509 -inform der -in certificate.der -noout -text

Several certificates in one file #

openssl x509 reads only the first certificate in a file. For a chain, use crl2pkcs7 as a splitter:

Subject and issuer of every certificate in a bundle
openssl crl2pkcs7 -nocrl -certfile fullchain.crt | openssl pkcs7 -print_certs -noout

Frequently asked questions

What does -noout do?
It suppresses the encoded form of the certificate in the output. Without it, OpenSSL prints the full decoding and re-emits the Base64 block, which is rarely what you want on screen.
How do I see just the SANs?
openssl x509 -in certificate.crt -noout -ext subjectAltName. The -ext flag takes any extension name and prints only that one, which is much cleaner than grepping the full text dump.
Why does the command fail on my .cer file?
Almost certainly because the file is DER-encoded and OpenSSL defaulted to PEM. Add -inform der. See that error explained.
How do I check a certificate on a live server rather than a file?
Pipe s_client into x509 — see fetch a certificate from a server.

References

Related pages