Reading an X.509 certificate with OpenSSL: subject, SAN, validity, key usage, and chain

Fields that matter

Subject and Issuer name the certificate holder and the CA that signed it. Validity has Not Before and Not After dates. The public key and algorithm come next. Extensions carry the important details: Subject Alternative Name (SAN) lists the DNS names and IPs the certificate is valid for, and browsers ignore the Common Name if SANs are present. Key Usage and Extended Key Usage restrict what the key can do, such as serverAuth. Basic Constraints says whether it is a CA certificate.

Inspecting

openssl x509 reads PEM or DER certificates. Select specific fields with -subject, -issuer, -dates, -ext, or print everything with -text.

Snippet

openssl x509 -in cert.pem -noout -subject -issuer -dates
openssl x509 -in cert.pem -noout -ext subjectAltName,keyUsage,extendedKeyUsage,basicConstraints
openssl x509 -in cert.pem -noout -fingerprint -sha256
openssl x509 -in cert.der -inform der -noout -text | less
openssl x509 -in cert.pem -noout -checkend 2592000 && echo 'valid for 30+ days'

Lab: create and read your own

Create a self-signed lab certificate with two SANs, inspect it, and confirm the SAN list and the CA:TRUE or FALSE flag. Then download the certificate of a public website you use and compare: issuer chain, validity length (public TLS certificates now have much shorter maximum lifetimes than they used to), and key type.

Snippet

openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -days 30 \
  -keyout lab.key -out lab.pem -subj '/CN=lab.internal' \
  -addext 'subjectAltName=DNS:lab.internal,DNS:www.lab.internal' \
  -addext 'basicConstraints=critical,CA:FALSE' -addext 'extendedKeyUsage=serverAuth'
openssl x509 -in lab.pem -noout -text | grep -A1 -E 'Alternative|Basic Constraints|Extended Key'

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

Common certificate errors

Name mismatch means the hostname is not in the SAN list. Expired or not yet valid means clock or renewal problems. Unable to get local issuer certificate means the chain is incomplete or the root is not trusted. Each maps directly to a field you can now read.

Diagram

Certificate fields and what they answer

Read the extension, not just the CN.

SANEKUdates

Subject / SAN

CN=lab.internal; DNS:lab.internal, DNS:www.lab.internal

Names this certificate is valid for

Validity

Not Before 2026-11-02, Not After 2026-12-02

30-day lifetime

Constraints and usage

CA:FALSE; EKU serverAuth

Leaf certificate for TLS servers

Check yourself

1. Which field do browsers use to match the hostname?

2. Which extension indicates whether a certificate may sign other certificates?

3. Which openssl x509 option checks whether a certificate expires within a number of seconds?