x509

Display certificate information

$ openssl x509 -in [certificate.pem] -noout -text

$ openssl x509 -in [certificate.pem] -noout -subject -issuer

$ openssl x509 -in [certificate.pem] -noout -dates

$ openssl x509 -in [certificate.pem] -noout -fingerprint -sha256

$ openssl x509 -in [cert.pem] -outform DER -out [cert.der]

$ openssl x509 -in [cert.der] -inform DER -out [cert.pem]

$ openssl x509 -in [certificate.pem] -noout -pubkey

$ openssl x509 -req -in [request.csr] -signkey [key.pem] -out [certificate.pem]

openssl x509 [-in file] [-out file] [-inform DER|PEM] [-outform DER|PEM] [-noout] [-text] [options]

openssl x509 is a multi-purpose certificate utility that displays certificate information, converts between formats, signs certificate requests, and modifies trust settings.
The command operates on X.509 certificates in PEM or DER format. Common operations include viewing certificate details (subject, issuer, validity, extensions), verifying signatures, converting between formats, and certificate signing.
When signing certificates (acting as a mini-CA), it can self-sign using -signkey or sign using a CA certificate and key with -CA and -CAkey options. The -days option specifies the validity period.
The command is typically invoked as openssl x509 rather than standalone x509.

-in file

Input certificate file. Reads from stdin if not specified.

Output file. Writes to stdout if not specified.

Input format: DER or PEM (default).

Output format: DER or PEM (default).

Prevent output of the encoded certificate.

Print certificate in human-readable text form.

Print the certificate subject name.

Print the certificate issuer name.

Print the notBefore and notAfter dates.

Print the certificate serial number.

Print certificate fingerprint (use with -sha256, -sha1, etc.).

Output the certificate's public key.

Input is a certificate request, not a certificate.

Self-sign using the specified private key.

Validity period in days when signing.

CA certificate to use for signing.

CA private key for signing.

PEM format is the default and more common for certificate exchange. DER format is binary and cannot contain multiple certificates. When converting formats, ensure the correct -inform is specified. Self-signed certificates may not be trusted by browsers without manual exception.

The x509 command has been part of OpenSSL since its early releases in the late 1990s. X.509 is an ITU-T standard for public key infrastructure, first published in 1988 and revised multiple times. The OpenSSL implementation provides comprehensive support for certificate manipulation and has become the standard tool for certificate operations on Unix-like systems.

openssl(1), openssl-req(1), openssl-verify(1), openssl-ca(1)