16

often cert files (in PEM) format contain multiple certs like:

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
.....
-----END CERTIFICATE-----

with the command: openssl x509 -in cert.pem -noout -text I can see the first entry.

Is there any built-in way to display the second entry or all entries.

Is there any simple way to view all entries?

What I'm really interested in are: C, ST, O, OU, CN, of subject, the issuer and the subject's validity dates

Improve this question

3 Answers 3

Reset to default
19

The post How to view all ssl certificates in a bundle? suggests several possibilities:

openssl crl2pkcs7 -nocrl -certfile CHAINED.pem | openssl pkcs7 -print_certs -text -noout
openssl crl2pkcs7 -nocrl -certfile CHAINED.pem | openssl pkcs7 -print_certs -noout (gives shorter output)
keytool -printcert -v -file <certs.crt>

The post contains more variations when using Perl, bash, awk and other utilities.

Improve this answer
2
  • 1
    Thanks a lot. I will mark this answer as solution as the crosslink shows multiple solutions.
    – gelonida
    Commented Nov 5, 2020 at 8:54
  • 1
    for openssl 1.1.1 and higher: a single-command answer can be found here serverfault.com/a/1079893 (openssl storeutl -noout -text -certs bundle.crt)
    – n0099
    Commented Sep 18, 2023 at 3:45
8

I would suggest a non-OpenSSL tool: another popular TLS stack, GnuTLS, has a similar certtool program which produces output in the same format.

certtool -i < multiplecerts.pem

(They do differ in some small details, such as decoding of less-common certificate extensions.)

Improve this answer
2
  • 1
    Indeed this helps. Will wait a little to see whether there are other answers, but this one will do for my tasks. I rephrased the title accordingly (replaced "with openssl" with "with openssl or another command"
    – gelonida
    Commented Nov 4, 2020 at 15:09
  • I makrjed the other answer as solutions as there are multiple suggestions. However for my personal usage I will use certtool
    – gelonida
    Commented Nov 5, 2020 at 8:55
1

I know this is old, but I found my way here looking to get the subject, validity dates, and issuer from a certificate chain in pem format that contained quite a few commented out lines.

So, on RHEL7 running bash 4.2.46 here's the solution I settled on after extensively reading through the sed documentation over at GNU.org: sed multiline techniques

for CULPRIT in $(sed -n '/^-----BEGIN.*CERTIFICATE-----/{n;p}' CHAIN-FILE-NAME); do
VICTIM="$(printf "${CULPRIT}" | sed -e 's,\/,\\\/,g')"
sed -e '/./{H;$!d;}' -e 'x;/'"${VICTIM}"'/!d' CHAIN-FILE-NAME | openssl x509 -subject -dates -issuer -noout
done
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .