OpenSSL certificate reference
OpenSSL certificate commands: inspect, check expiry, verify a chain, match a key
This is a lookup table, not a tutorial. Each row is a command you can paste, with the question it answers. The commands assume OpenSSL 1.1.1 or later; where a flag needs a newer release it is called out in the row.
Decision brief
- Primary query
- openssl check certificate expiration
- Best for
- Engineers who run PKI or own cryptographic change and need reviewable evidence rather than a spreadsheet.
- Safety boundary
- Evidence supports decisions; it is not proof of implementation safety or compliance.
Most certificate incidents are diagnosed with four facts: what the certificate says, when it expires, whether the chain the server presents is complete and correctly ordered, and whether the private key on disk matches the certificate being served. OpenSSL answers all four from the command line, which is why it stays useful long after a dashboard has told you something is wrong without telling you what.
Two distinctions cause most confusion. Reading a file and reading a live endpoint are different operations: openssl x509 parses a file, openssl s_client speaks TLS and returns what the server sent. And a certificate that a browser accepts may still be misconfigured, because browsers repair an incomplete or misordered chain using cached intermediates while non-browser clients such as curl, Java, and Go do not.
Expiry checking is the one command worth wiring into automation rather than running by hand. The -checkend flag returns a non-zero exit status when a certificate will expire within the given number of seconds, so it slots straight into a monitoring check without any date parsing. Reading the notAfter string and comparing dates in a shell script is where certificate monitors usually acquire their bugs.
Reference
Values you can look up and check against your own systems
Read a certificate
| Question | Command |
|---|---|
| Show everything in a certificate file | openssl x509 -in cert.pem -noout -text |
| Subject, issuer and validity only | openssl x509 -in cert.pem -noout -subject -issuer -dates |
| Subject alternative names | openssl x509 -in cert.pem -noout -ext subjectAltName |
| Serial number and fingerprint | openssl x509 -in cert.pem -noout -serial -fingerprint -sha256 |
| Read a DER certificate instead of PEM | openssl x509 -in cert.der -inform DER -noout -text |
| Read a certificate out of a PKCS#12 bundle | openssl pkcs12 -in bundle.pfx -nokeys -clcerts | openssl x509 -noout -text |
Check expiry
The -checkend flag exits 1 if the certificate expires within the given number of seconds and 0 if it does not, which is what makes it usable in a monitoring check.
| Question | Command |
|---|---|
| When does this file expire? | openssl x509 -in cert.pem -noout -enddate |
| Will it expire within 30 days? | openssl x509 -in cert.pem -noout -checkend 2592000 |
| Has it already expired? | openssl x509 -in cert.pem -noout -checkend 0 |
| When does a live endpoint's certificate expire? | openssl s_client -connect host:443 -servername host </dev/null 2>/dev/null | openssl x509 -noout -enddate |
| Expiry of every certificate in a directory | for f in *.pem; do echo "$f $(openssl x509 -in "$f" -noout -enddate)"; done |
Inspect a live endpoint
The -servername flag sends SNI. Without it a virtual-hosted server returns its default certificate, not the one you meant to test.
| Question | Command |
|---|---|
| What certificate does this host serve? | openssl s_client -connect host:443 -servername host </dev/null 2>/dev/null | openssl x509 -noout -text |
| Show the full chain the server sent | openssl s_client -connect host:443 -servername host -showcerts </dev/null |
| Which protocol and cipher were negotiated? | openssl s_client -connect host:443 -servername host </dev/null 2>&1 | grep -E 'Protocol|Cipher' |
| Test a mail server with STARTTLS | openssl s_client -starttls smtp -connect host:587 |
| Test a Postgres endpoint | openssl s_client -starttls postgres -connect host:5432 |
Verify trust and chain order
A chain must run leaf, then intermediate, then optionally root. Browsers often repair a wrong order; curl, Java and Go clients do not.
| Question | Command |
|---|---|
| Does this chain verify against the system store? | openssl verify -untrusted chain.pem cert.pem |
| Verify against a specific CA bundle | openssl verify -CAfile ca-bundle.pem cert.pem |
| Which certificate issued this one? | openssl x509 -in cert.pem -noout -issuer |
| Is the served chain complete? | openssl s_client -connect host:443 -servername host -showcerts </dev/null 2>&1 | grep -c 'BEGIN CERTIFICATE' |
| Check a certificate against a CRL | openssl verify -crl_check -CAfile ca-bundle.pem -CRLfile crl.pem cert.pem |
Keys and signing requests
The three modulus hashes must be identical. If the key hash differs from the certificate hash, the server is holding the wrong key.
| Question | Command |
|---|---|
| Hash of the certificate modulus | openssl x509 -noout -modulus -in cert.pem | openssl sha256 |
| Hash of the private key modulus | openssl rsa -noout -modulus -in key.pem | openssl sha256 |
| Hash of the CSR modulus | openssl req -noout -modulus -in req.csr | openssl sha256 |
| Read and self-verify a CSR | openssl req -in req.csr -noout -text -verify |
| New key and CSR in one step | openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.csr |
| CSR with subject alternative names | openssl req -new -key key.pem -out req.csr -addext "subjectAltName=DNS:a.example,DNS:b.example" |
| Self-signed certificate for a lab | openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 90 |
| Bundle a key and certificate into PKCS#12 | openssl pkcs12 -export -inkey key.pem -in cert.pem -certfile chain.pem -out bundle.pfx |
Post-quantum additions in OpenSSL 3.5 and later
These subcommands do not exist in OpenSSL 3.4 or earlier. Check with openssl version first.
| Question | Command |
|---|---|
| Which TLS groups does this build offer? | openssl list -tls-groups |
| Are ML-KEM hybrids available? | openssl list -tls-groups | grep -i mlkem |
| Which signature algorithms are available? | openssl list -signature-algorithms |
| Generate an ML-DSA-65 key | openssl genpkey -algorithm ML-DSA-65 -out mldsa.key |
| Which group did this handshake use? | openssl s_client -connect host:443 -tls1_3 </dev/null 2>&1 | grep -i 'Negotiated TLS1.3 group' |
Capabilities
What the operating model needs to do
File and endpoint separated
The x509 subcommand parses what is on disk. The s_client subcommand reports what a server actually sends, including a chain that disagrees with the file you deployed.
Expiry as an exit code
The -checkend flag gives a threshold check with no date arithmetic, which is the difference between a monitor that works and one that silently rots.
Chain order visible
The -showcerts flag prints the chain in the order the server sent it, which is the only way to see the misordering that browsers hide.
Key and certificate matched
Comparing modulus hashes across key, certificate and CSR settles the most common deployment mistake in one line.
Workflow
A repeatable path to evidence
Use explicit scope, accountable decisions, and verification gates. Keep unknowns visible so progress is not manufactured by narrowing the denominator.
- 1
Reproduce from outside
Query the endpoint over the network before reading anything on the host. The served certificate and the file on disk are frequently different.
- 2
Read the dates
Check notBefore as well as notAfter. A certificate installed early is as broken as one installed late.
- 3
Verify the chain
Run openssl verify against an explicit CA bundle rather than trusting that a browser accepted it.
- 4
Record it
Put the endpoint, issuer, expiry, key algorithm and negotiated group into the inventory so the next expiry is not a surprise.
Expected deliverables
Artifacts the next team can inspect
- Per-endpoint certificate record with issuer and expiry
- Chain completeness and ordering result
- Key-to-certificate match evidence
- Automated -checkend threshold check
- Negotiated protocol, cipher and group per endpoint
Buyer checklist
Questions for a proof of value
- 01Is expiry monitored on the served certificate or only on the file in the repository?
- 02Does the monitor check the whole chain, or only the leaf?
- 03How are internal and private-CA certificates covered?
- 04Where are certificates that no automation knows about, such as appliances and vendor endpoints?
- 05Is the key algorithm and negotiated group recorded alongside expiry?
Limits and cautions
What this page does not promise
- Only run these commands against systems you are authorized to test. The s_client subcommand opens a real connection.
- A certificate a browser accepts can still fail for curl, Java or Go clients when the chain is incomplete or misordered.
- Command flags vary between OpenSSL 1.1.1, 3.x and LibreSSL. Confirm with openssl version before assuming a flag exists.
- Never publish or paste private key material while diagnosing. The modulus hash is enough to prove a match.
Primary sources
Continue evaluating
Related decision pages
PQC parameter reference
ML-KEM, ML-DSA and SLH-DSA: parameter sets, key and signature sizes
Byte sizes and security categories for every FIPS 203, 204 and 205 parameter set, what each algorithm replaces, and the size changes that break protocols and hardware assumptions during migration.
Read pageImplementation guide
How to build and maintain a cryptographic inventory
A practical guide to inventory scope, evidence, asset identity, confidence, ownership, CBOM export, continuous discovery, and migration use.
Read pageCBOM guide
Cryptographic bill of materials: what a CBOM contains and how to use it
Understand CBOM scope, CycloneDX cryptographic assets, evidence, relationships, confidence, validation, diffs, and post-quantum migration use.
Read pageCryptographic inventory software
A cryptographic inventory your engineering teams can keep current
Discover cryptographic assets in source, dependencies, configuration, containers, and authorized TLS endpoints. Preserve evidence, ownership, and change history in one inventory.
Read pageTalk to us about one representative repository
Qubrisk is in development and there is no self-serve signup yet. Tell us what your estate looks like and we will show you the evidence, the CBOM output, and the limits, without a sales sequence.