x509 Certificate & OpenSSL Commands Explained

This article explains what an X.509 certificate is and how to inspect, create, and manage these certificates using the OpenSSL command-line tool. You will learn the key components of a certificate, the most useful OpenSSL commands, and how to troubleshoot common certificate errors.

What Is an X.509 Certificate?

An X.509 certificate is a digital document that binds a public key to an identity (such as a domain name, organization, or person). It is the backbone of TLS/SSL, the protocol that encrypts HTTPS traffic. The certificate contains the public key, information about the subject (who the certificate is issued to), the issuer (who signed it), validity dates, and a digital signature from a Certificate Authority (CA). This signature proves that a trusted third party has verified the identity.

Common uses include securing websites (HTTPS), email signing (S/MIME), code signing, and client authentication. Without X.509 certificates, you could not trust that the website you are connecting to is actually the one it claims to be.

What Is OpenSSL and Why Use It?

OpenSSL is a free, open-source software library and command-line tool that implements the SSL and TLS protocols, as well as a wide range of cryptographic functions. It is the de facto standard for working with certificates on Linux, macOS, and Windows (via WSL or native builds). The openssl command lets you generate private keys, create certificate signing requests (CSRs), self-sign certificates, convert formats, and inspect existing certificates—all without needing a GUI.

Key Components of an X.509 Certificate

To understand the output of OpenSSL commands, you need to know the main fields:

• Subject: The entity the certificate is issued to (e.g., CN=example.com).
• Issuer: The entity that signed the certificate (e.g., CN=Let's Encrypt). For self-signed certificates, subject and issuer are the same.
• Validity: Not Before and Not After dates. The certificate is only valid during this period.
• Public Key: The public key (RSA, ECDSA, etc.) that corresponds to the private key held by the subject.
• Signature Algorithm: The algorithm used to sign the certificate (e.g., sha256WithRSAEncryption).
• Serial Number: A unique number assigned by the issuer.
• Extensions: Additional fields like Subject Alternative Name (SAN), Key Usage, and Basic Constraints. Modern browsers require SAN to include the domain names.

Essential OpenSSL Commands for X.509

Here are the most common commands you will use:

1. View a certificate: openssl x509 -in cert.pem -text -noout – prints all fields in a human-readable format. Use -noout to suppress the base64-encoded certificate itself.
2. View a certificate from a remote server: openssl s_client -connect example.com:443 -showcerts – connects to a server and displays its certificate chain. Add | openssl x509 -text -noout to see only the leaf certificate details.
3. Generate a private key: openssl genrsa -out key.pem 2048 – creates an RSA private key with 2048-bit strength. For ECDSA, use openssl ecparam -genkey -name prime256v1 -out key.pem.
4. Create a CSR: openssl req -new -key key.pem -out request.csr – prompts for subject details and generates a certificate signing request.
5. Self-sign a certificate: openssl x509 -req -in request.csr -signkey key.pem -out cert.pem -days 365 – creates a self-signed certificate valid for 365 days. Add -extfile to include SANs.
6. Check a certificate’s dates: openssl x509 -in cert.pem -noout -dates – shows the notBefore and notAfter dates.
7. Check a certificate’s subject and issuer: openssl x509 -in cert.pem -noout -subject -issuer – quick summary.
8. Verify a certificate against a CA: openssl verify -CAfile ca.pem cert.pem – checks the chain of trust.

How to Read the Output

When you run openssl x509 -in cert.pem -text -noout, the output starts with the certificate data, then the signature, and finally the public key. Key things to look for:

• The Subject line shows the CN (Common Name) and other identifiers.
• The Validity section shows the exact dates. If the current date is outside this range, the certificate is expired.
• The Subject Alternative Name extension lists all domain names and IP addresses the certificate is valid for. If you are getting a hostname mismatch error, check this.
• The Issuer tells you who signed it. If it is self-signed, the issuer will match the subject.

Common Problems and Solutions

Here are typical issues you might encounter and how to fix them:

• Certificate expired: Check the dates with openssl x509 -in cert.pem -noout -dates. Renew the certificate and update your server.
• Hostname mismatch: The certificate does not have the domain name you are using in the SAN extension. Re-issue the certificate with the correct SAN.
• Untrusted certificate: The certificate is not signed by a CA in your trust store. For self-signed certificates, you need to add the CA to your trust store or use a recognized CA.
• Private key mismatch: The private key does not match the public key in the certificate. Compare the modulus (for RSA) with openssl x509 -in cert.pem -noout -modulus and openssl rsa -in key.pem -noout -modulus. They must be identical.
• Wrong format: Certificates come in PEM (base64) and DER (binary). Convert with openssl x509 -in cert.der -inform DER -out cert.pem -outform PEM.

Comparing X.509 with Other Formats

You may encounter other certificate formats, but X.509 is the standard. The PKCS#12 (.p12 or .pfx) format bundles the certificate and private key into a single encrypted file. OpenSSL can convert: openssl pkcs12 -export -out bundle.p12 -inkey key.pem -in cert.pem. The PKCS#7 (.p7b) format contains only certificates, not private keys. X.509 is the underlying structure; PEM and DER are just encoding wrappers.

Frequently Asked Questions

What is the difference between PEM and DER?

PEM is a base64-encoded text format with header and footer lines (e.g., -----BEGIN CERTIFICATE-----). DER is a binary format. PEM is more common for web servers and is easier to copy-paste. DER is often used on Windows systems. OpenSSL can convert between them.

How do I create a self-signed certificate for local development?

Run openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes. This generates a private key and a self-signed certificate in one command. Add -addext "subjectAltName=DNS:localhost" to include localhost in the SAN.

Why does my browser say “ERR_CERT_AUTHORITY_INVALID”?

This means the browser does not trust the issuer of the certificate. For a self-signed certificate, you need to manually add it to your operating system’s trust store. For a public site, the certificate chain is incomplete—ensure your server sends the intermediate certificates.

How do I check when a certificate expires?

Use openssl x509 -in cert.pem -noout -enddate to see the expiry date. For a remote server, use echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate.

What is the difference between a CSR and a certificate?

A CSR (Certificate Signing Request) is a file you create with your public key and identity details. You send it to a CA, which signs it and returns a certificate. The certificate is the signed version that you install on your server. The CSR itself is not a certificate.

Can I use the same private key for multiple certificates?

Yes, but it is not recommended. If one certificate is compromised, all others using the same key are also compromised. It is best practice to generate a new private key for each certificate.

Related

• Exif Metadata: Keep or Remove?
• Sailor Piece Relics Guide
• D rex vs Armillaria: Giant Fungi Compared