openssl-x509(1)
Display and sign X.509 certificates, including extracting fields, converting formats, and validating certificate chains.
Synopsis
openssl x509 [OPTIONS] [INFILE] [OUTFILE]Description
The openssl x509 command is a certificate utility that reads and processes X.509 certificates in PEM or DER format. It can display certificate information, extract public keys, convert between formats, sign certificates with a CA key, and verify certificate chains.
Common uses include viewing certificate details, converting between PEM and DER formats, extracting the public key or subject alternative names, and self-signing certificates during the CA setup process.
Common options
| Flag | What it does |
|---|---|
-in FILE | Input certificate file (PEM or DER format); defaults to stdin |
-out FILE | Output file for the certificate or extracted data; defaults to stdout |
-text | Print certificate in human-readable text format |
-noout | Suppress PEM encoding of the certificate in output (useful with -text or -subject) |
-subject | Print the certificate subject name |
-issuer | Print the certificate issuer name |
-dates | Print the certificate notBefore and notAfter validity dates |
-pubkey | Extract and print the public key from the certificate |
-fingerprint | Print the certificate fingerprint (SHA-1 by default) |
-inform PEM|DER | Input certificate format (PEM is default) |
-outform PEM|DER|TEXT | Output certificate format (PEM is default) |
-CAkey FILE | CA private key file for signing the certificate request |
Examples
Display the full certificate details in human-readable text format
openssl x509 -in cert.pem -text -nooutExtract and print only the subject distinguished name
openssl x509 -in cert.pem -subject -nooutShow the certificate validity dates (notBefore and notAfter)
openssl x509 -in cert.pem -dates -nooutPrint the certificate SHA-1 fingerprint for identification
openssl x509 -in cert.pem -fingerprint -nooutExtract the public key from the certificate
openssl x509 -in cert.pem -pubkey -nooutConvert a DER-format certificate to PEM format
openssl x509 -in cert.der -inform DER -outform PEM -out cert.pemSign a certificate signing request (CSR) with a CA certificate and private key
openssl x509 -req -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server.crt -days 365Display both the issuer and subject names of the certificate
openssl x509 -in cert.pem -issuer -subject -noout