How to view certificate details using OpenSSL

X.509 certificate files carry identity and policy fields that need inspection before renewal, installation, ticket handoff, or incident review. OpenSSL can decode a local certificate file and show who it names, who issued it, when it is valid, and which TLS roles or hostnames it claims.

The openssl x509 command reads certificate files without modifying them. Focused options print the common handoff fields, while -text exposes extensions such as Subject Alternative Name, Key Usage, Extended Key Usage, and Basic Constraints.

Decoded fields are local-file evidence, not deployment validation. A file can parse correctly while a proxy serves a different certificate, a chain is incomplete, or a client rejects the issuer, name, or revocation status. Use the serial number and SHA-256 fingerprint as exact-file identifiers, and use chain or live endpoint checks when the deployed service itself needs proof.

1. Print the core certificate identity, validity, and fingerprint fields.

   $ openssl x509 -in server.crt -noout -subject -issuer -serial -dates -fingerprint -sha256
   subject=O=Example Operations, CN=server.example.com
   issuer=O=Example Operations, CN=server.example.com
   serial=1001
   notBefore=Jun 30 07:11:48 2026 GMT
   notAfter=Sep 28 07:11:48 2026 GMT
   sha256 Fingerprint=7D:36:33:01:D0:4E:E3:36:E1:40:D1:6A:6A:A3:21:45:A5:64:EB:8E:01:66:EF:61:DD:89:00:A4:36:D1:B6:C9

   Replace server.crt with the certificate path. -noout prevents OpenSSL from reprinting the PEM certificate body, and -sha256 prints the fingerprint used to compare the exact certificate file across systems.

2. Decode the certificate fields and extensions when usage or name details matter.

   $ openssl x509 -in server.crt -noout -text -certopt no_pubkey,no_sigdump
   Certificate:
       Data:
           Version: 3 (0x2)
           Serial Number: 4097 (0x1001)
           Signature Algorithm: sha256WithRSAEncryption
           Issuer: O=Example Operations, CN=server.example.com
           Validity
               Not Before: Jun 30 07:11:48 2026 GMT
               Not After : Sep 28 07:11:48 2026 GMT
           Subject: O=Example Operations, CN=server.example.com
           X509v3 extensions:
               X509v3 Subject Key Identifier: 
                   E4:A7:8F:95:B7:0A:6A:65:A1:32:E8:CF:66:4C:A7:F7:82:B4:1A:DA
               X509v3 Authority Key Identifier: 
                   E4:A7:8F:95:B7:0A:6A:65:A1:32:E8:CF:66:4C:A7:F7:82:B4:1A:DA
               X509v3 Subject Alternative Name: 
                   DNS:server.example.com, DNS:www.example.com
               X509v3 Basic Constraints: 
                   CA:FALSE
               X509v3 Key Usage: 
                   Digital Signature, Key Encipherment
               X509v3 Extended Key Usage: 
                   TLS Web Server Authentication

   -certopt no_pubkey,no_sigdump keeps the decoded view focused by omitting the bulky public-key block and signature hex dump while leaving certificate fields and extensions visible.

3. Print only the Subject Alternative Name extension when checking name coverage.

   $ openssl x509 -in server.crt -noout -ext subjectAltName
   X509v3 Subject Alternative Name: 
       DNS:server.example.com, DNS:www.example.com

   Modern TLS hostname checks use Subject Alternative Name entries. A familiar Common Name in the subject is not enough proof that a server name is covered.

4. Check the expected DNS name against the certificate.

   $ openssl x509 -in server.crt -noout -checkhost server.example.com
   Hostname server.example.com does match certificate

   Use the DNS name that clients request. A match here proves name coverage inside this file, not that the deployed endpoint is serving this certificate.

5. Read a binary DER certificate with an explicit input format.

   $ openssl x509 -inform DER -in server.der -noout -subject -issuer -dates
   subject=O=Example Operations, CN=server.example.com
   issuer=O=Example Operations, CN=server.example.com
   notBefore=Jun 30 07:11:48 2026 GMT
   notAfter=Sep 28 07:11:48 2026 GMT

   Use -inform DER for binary certificate files such as many .der or .cer files. If the command still fails, the file may be a different certificate container rather than a single DER-encoded X.509 certificate.