info > openssl-x509(1)

🔖 NAME

openssl-x509 - Certificate display and signing command

🚀 Quick Reference

Use Case	Command	Description
📄 Print certificate contents	openssl x509 -in cert.pem -noout -text	Display full certificate details in text form
🔑 Print subject alternative names	openssl x509 -in cert.pem -noout -ext subjectAltName	Show SAN extension(s)
🔢 Print serial number	openssl x509 -in cert.pem -noout -serial	Display certificate serial number
👤 Print subject name	openssl x509 -in cert.pem -noout -subject	Show certificate subject
🖐️ Print SHA1 fingerprint	openssl x509 -sha1 -in cert.pem -noout -fingerprint	Display SHA1 digest of DER-encoded certificate
🔄 Convert PEM to DER	openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER	Change certificate format
📝 Convert certificate to request	openssl x509 -x509toreq -in cert.pem -out req.pem -key key.pem	Generate PKCS#10 CSR from certificate
🏛️ Sign a request with CA	openssl x509 -req -in req.pem -CA cacert.pem -CAkey key.pem -CAcreateserial	Micro-CA signing of a CSR
🔐 Self-sign a request	openssl x509 -req -in careq.pem -extfile openssl.cnf -extensions v3_ca -key key.pem -out cacert.pem	Create self-signed certificate with extensions
✅ Check expiration	openssl x509 -in cert.pem -checkend 86400	Check if certificate expires within 86400 seconds (1 day)

📋 SYNOPSIS

openssl x509 [-help] [-in filename|uri] [-passin arg] [-new]
[-x509toreq] [-req] [-copy_extensions arg] [-inform DER|PEM] [-vfyopt
nm:v] [-key filename|uri] [-keyform DER|PEM|P12|ENGINE] [-signkey
filename|uri] [-out filename] [-outform DER|PEM] [-nocert] [-noout]
[-dateopt] [-text] [-certopt option] [-fingerprint] [-alias] [-serial]
[-startdate] [-enddate] [-dates] [-subject] [-issuer] [-nameopt option]
[-email] [-hash] [-subject_hash] [-subject_hash_old] [-issuer_hash]
[-issuer_hash_old] [-ext extensions] [-ocspid] [-ocsp_uri] [-purpose]
[-pubkey] [-modulus] [-checkend num] [-checkhost host] [-checkemail
host] [-checkip ipaddr] [-set_serial n] [-next_serial] [-days arg]
[-preserve_dates] [-subj arg] [-force_pubkey filename] [-clrext]
[-extfile filename] [-extensions section] [-sigopt nm:v] [-badsig]
[-digest] [-CA filename|uri] [-CAform DER|PEM|P12] [-CAkey
filename|uri] [-CAkeyform DER|PEM|P12|ENGINE] [-CAserial filename]
[-CAcreateserial] [-trustout] [-setalias arg] [-clrtrust] [-addtrust
arg] [-clrreject] [-addreject arg] [-rand files] [-writerand file]
[-engine id] [-provider name] [-provider-path path] [-propquery propq]

📝 DESCRIPTION

This command is a multi-purposes certificate handling command. It can be used to print certificate information, convert certificates to various forms, edit certificate trust settings, generate certificates from scratch or from certificate requests and then self-signing them or signing them like a "micro CA".

Since there are a large number of options they will split up into various sections.

⚙️ OPTIONS

📥 Input, Output, and General Purpose Options

• -help — Print out a usage message.
• -in filename|uri — Specifies the input to read a certificate from or the input file for reading a certificate request if the -req flag is used. Defaults to standard input. Cannot be combined with -new.
• -passin arg — The key and certificate file password source. See openssl-passphrase-options(1).
• -new — Generate a certificate from scratch, not using an input certificate or request. Requires -subj. Public key from -force_pubkey or -key (implies self-signature).
• -x509toreq — Output a PKCS#10 certificate request (rather than a certificate). Requires -key for self-signing.
• -req — Expect a PKCS#10 certificate request as input (must be correctly self-signed).
• -copy_extensions arg — Handle X.509 extensions when converting between certificate and request. Values: none, copy, copyall.
• -inform DER|PEM — Input file format. See openssl-format-options(1).
• -vfyopt nm:v — Pass options to signature algorithm during verify operations.
• -key filename|uri — Private key for signing. Cannot be used with -CA. Sets issuer to subject (self-issued).
• -signkey filename|uri — Alias of -key.
• -keyform DER|PEM|P12|ENGINE — Key input format.
• -out filename — Output filename (default stdout).
• -outform DER|PEM — Output format (default PEM).
• -nocert — Do not output a certificate.
• -noout — Prevent output except for printing options.

🖨️ Certificate Printing Options

Note: -alias and -purpose are described in "Trust Settings" section.

• -dateopt — Specify date output format: rfc_822 or iso_8601 (default rfc_822).
• -text — Prints certificate in text form (full details).
• -certopt option — Customise print format with -text. See "Text Printing Flags" below.
• -fingerprint — Calculate and print the digest of the DER-encoded certificate (fingerprint).
• -alias — Print certificate alias (nickname).
• -serial — Print certificate serial number.
• -startdate — Print notBefore date.
• -enddate — Print notAfter date.
• -dates — Print both start and expiry dates.
• -subject — Print subject name.
• -issuer — Print issuer name.
• -nameopt option — Display options for subject/issuer names. See openssl-namedisplay-options(1).
• -email — Print email addresses if any.
• -hash — Synonym for -subject_hash.
• -subject_hash — Print hash of subject name (used for directory indexing).
• -subject_hash_old — Print hash using older algorithm (pre-1.0.0).
• -issuer_hash — Print hash of issuer name.
• -issuer_hash_old — Print hash using older algorithm.
• -ext extensions — Print certificate extensions in text form. Comma-separated list.
• -ocspid — Print OCSP hash values for subject name and public key.
• -ocsp_uri — Print OCSP responder addresses.
• -purpose — Perform tests on certificate extensions and output results.
• -pubkey — Print SubjectPublicKeyInfo in PEM format.
• -modulus — Print value of modulus of public key.

✅ Certificate Checking Options

• -checkend arg — Check if certificate expires within arg seconds. Exits nonzero if yes.
• -checkhost host — Check that certificate matches specified host.
• -checkemail email — Check that certificate matches specified email.
• -checkip ipaddr — Check that certificate matches specified IP address.

📤 Certificate Output Options

• -set_serial n — Set serial number (decimal or hex with "0x"). Overrides serial file if used with -CA.
• -next_serial — Set serial to one more than the number in the certificate.
• -days arg — Number of days until expiration (default 30). Cannot be used with -preserve_dates.
• -preserve_dates — Preserve notBefore/notAfter from input certificate. Cannot be used with -days.
• -subj arg — Set subject name (format: /type0=value0/type1=value1/...).
• -force_pubkey filename — Set public key from file instead of input/key option.
• -clrext — Clear all extensions from source when transforming.
• -extfile filename — Configuration file containing X.509 extensions to add.
• -extensions section — Section in extfile to use for extensions.
• -sigopt nm:v — Pass options to signature algorithm during signing (may be repeated).
• -badsig — Corrupt signature before writing (for testing).
• -digest — Digest to use (affects signing and printing). Default SHA1 for -fingerprint, SHA256 for signing.

🏛️ Micro-CA Options

• -CA filename|uri — CA certificate to use for signing. Behaves as "micro CA". Cannot be used with -key.
• -CAform DER|PEM|P12 — Format of CA certificate.
• -CAkey filename|uri — CA private key (must match CA certificate).
• -CAkeyform DER|PEM|P12|ENGINE — Format of CA key.
• -CAserial filename — Serial number file (default: CA certificate basename with .srl).
• -CAcreateserial — Create serial number file if missing (initial value "02", first serial "1").

🔐 Trust Settings

A trusted certificate is an ordinary certificate with additional information: permitted/prohibited uses and an alias. Trust settings are currently only used with root CAs.

• -trustout — Mark output as trusted certificate. Automatically set if trust settings are modified.
• -setalias arg — Set alias (nickname) for the certificate.
• -clrtrust — Clear all permitted/trusted uses.
• -addtrust arg — Add a trusted certificate use (e.g., clientAuth, serverAuth, emailProtection).
• -clrreject — Clear all prohibited/rejected uses.
• -addreject arg — Add a prohibited trust anchor purpose.

🔧 Generic Options

• -rand files, -writerand file — Random state options. See openssl(1).
• -engine id — Engine options (deprecated).
• -provider name, -provider-path path, -propquery propq — Provider options. See openssl(1), provider(7), property(7).

📄 Text Printing Flags

These options customise the -text output using -certopt:

• compatible — Use old format (no printing options).
• no_header — Don't print "Certificate" and "Data" headers.
• no_version — Don't print version number.
• no_serial — Don't print serial number.
• no_signame — Don't print signature algorithm.
• no_validity — Don't print notBefore/notAfter.
• no_subject — Don't print subject name.
• no_issuer — Don't print issuer name.
• no_pubkey — Don't print public key.
• no_sigdump — Don't give hexadecimal dump of signature.
• no_aux — Don't print trust information.
• no_extensions — Don't print X509V3 extensions.
• ext_default — Default behaviour: attempt to print unsupported extensions.
• ext_error — Print error for unsupported extensions.
• ext_parse — ASN1 parse unsupported extensions.
• ext_dump — Hex dump unsupported extensions.
• ca_default — Value used by openssl-ca(1) (equivalent to no_issuer, no_pubkey, no_header, no_version).

📚 EXAMPLES

Note: In these examples, the '\' means the example should be all on one line.

📄 Print the contents of a certificate:

openssl x509 -in cert.pem -noout -text

🔑 Print the "Subject Alternative Name" extension:

openssl x509 -in cert.pem -noout -ext subjectAltName

📜 Print more extensions:

openssl x509 -in cert.pem -noout -ext subjectAltName,nsCertType

🔢 Print the certificate serial number:

openssl x509 -in cert.pem -noout -serial

👤 Print the subject name:

openssl x509 -in cert.pem -noout -subject

🏷️ Print subject name in RFC2253 form:

openssl x509 -in cert.pem -noout -subject -nameopt RFC2253

🌐 Print subject name in oneline form on a UTF8 terminal:

openssl x509 -in cert.pem -noout -subject -nameopt oneline,-esc_msb

🖐️ Print SHA1 fingerprint:

openssl x509 -sha1 -in cert.pem -noout -fingerprint

🔄 Convert PEM to DER:

openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER

📝 Convert certificate to request:

openssl x509 -x509toreq -in cert.pem -out req.pem -key key.pem

🏛️ Convert a certificate request into a self-signed CA certificate:

openssl x509 -req -in careq.pem -extfile openssl.cnf -extensions v3_ca \
       -key key.pem -out cacert.pem

🔐 Sign a request using a CA certificate and add user extensions:

openssl x509 -req -in req.pem -extfile openssl.cnf -extensions v3_usr \
       -CA cacert.pem -CAkey key.pem -CAcreateserial

🔒 Set certificate to be trusted for SSL client use and set alias:

openssl x509 -in cert.pem -addtrust clientAuth \
       -setalias "Steve's Class 1 CA" -out trust.pem

📝 NOTES

• The conversion to UTF8 format used with the name options assumes that T61Strings use the ISO8859-1 character set. This is incorrect but common practice.
• The -email option searches the subject name and subject alternative name extension. Only unique email addresses are printed.

🐛 BUGS

• It is possible to produce invalid certificates or requests by specifying the wrong private key, using unsuitable X.509 extensions, or using inconsistent options.
• There should be options to explicitly set start and end dates rather than an offset from the current time.

🔗 SEE ALSO

• openssl(1)
• openssl-req(1)
• openssl-ca(1)
• openssl-genrsa(1)
• openssl-gendsa(1)
• openssl-verify(1)
• x509v3_config(5)

📜 HISTORY

• The hash algorithm used in -subject_hash and -issuer_hash before OpenSSL 1.0.0 was based on MD5. In 1.0.0+ it uses SHA1 on a canonical DN. Directories must be rebuilt with openssl-rehash(1).
• The -signkey option was renamed to -key in OpenSSL 3.0 (old name kept as alias).
• The -engine option was deprecated in OpenSSL 3.0.
• The -C option was removed in OpenSSL 3.0.

©️ COPYRIGHT

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.