Inspect a certificate file with openssl x509
Decode a local .crt or .pem file to see its subject, issuer, SANs, and expiry — no network connection needed.
Run `openssl x509 -in server.crt -noout -text` to print the full decoded certificate; add `-noout -dates` for just the validity window.
01Command
Command
$ openssl x509 -in server.crt -noout -text02What it does
Where `openssl s_client` inspects a live server's handshake, `openssl x509 -in file` reads a certificate from disk — the right tool for checking what you're about to deploy. `-noout` suppresses re-printing the base64 blob so only decoded fields show; `-text` gives everything including Subject Alternative Names, which modern clients require instead of CN. Quick filters: `-dates` for validity, `-subject`/`-issuer` for identity, and `-fingerprint -sha256` for comparing certs out-of-band.
03Risk
!Warning: A .pem file may chain multiple certificates; openssl x509 shows only the first — split the chain with awk/csplit first if you need each one.
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- openssl-x509(1) — certificate display and signingEvidence: Documents -in, -noout, and -text for printing the full decoded contents of a certificate file.
Last verified: 2026-09-17 · Category: Security & Privacy