Viewing the contents of an SSL CERT
You have that shiny new SSL CERT you purchased online, but how do you know it’s properly tagged and signed?
What if you find a cert on your system and you want to know what it covers, when it expires, whom might own it, etc.
Well, that’s possible using the openssl command line tool.
Running a simple command we’ll examine the SSL Cert. The important info is in the ‘Issuer’ and ‘Subject’ blocks.
openssl x509 -noout -text -in my.super-awesome.hostname.cert
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
c4:3d:66:b4:e3:cc:61:86
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=Kellyfornia, L=Sac-of-Tomatoes, O=Crazy Assembly House, OU=Committe on wasting tax payer money, CN=*.super-awesome.net/emailAddress=admin@super-awesome.net
Validity
Not Before: Jan 9 17:50:56 2012 GMT
Not After : Jan 6 17:50:56 2022 GMT
Subject: C=US, ST=Kellyfornia, L=Sac-of-Tomatoes, O=Crazy Assembly House, OU=Committe on wasting tax payer money, CN=*.super-awesome.net/emailAddress=admin@super-awesome.net
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (2048 bit)
Modulus (2048 bit):
[...] /* removed the modulus to keep the post short */
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
9D:72:0C:A0:E6:EB:77:2C:77:EF:E8:9E:B7:BC:9F:53:81:1A:40:9D
X509v3 Authority Key Identifier:
keyid:9D:72:0C:A0:E6:EB:77:2C:77:EF:E8:9E:B7:BC:9F:53:81:1A:40:9D
DirName:/C=US/ST=Kellyfornia/L=Sac-of-Tomatoes/O=Crazy Assembly House/OU=Committe on wasting tax payer money/CN=*.super-awesome.net/emailAddress=admin@super-awesome.net
serial:C4:3D:66:B4:E3:CC:61:86
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha1WithRSAEncryption
[...] /* removed the signature to keep the post short */
Looking at the Subject breaks downs as follows:
Subject: C=US, ST=Kellyfornia, L=Sac-of-Tomatoes, O=Crazy Assembly House, OU=Committe on wasting tax payer money, CN=*.super-awesome.net/emailAddress=admin@super-awesome.net C=US - Country code 'US' ST=Kellyfornia - State or Provence. Sac-of-Tomatoes - City/Location O=Crazy Assembly House - Company or Organization name OU=Committe on wasting tax payer money Organizational Unit (department, etc.) CN=*.super-awesome.net - Canonical Name (hostname / domain) that the CERT services. In this case it's a wildcard, signfied by the '*'
That’s all there is to it. Now, secure those website communications!