210

I am using Java keytool. I have exported a self-signed .pem certificate from my keystore. Is there a command to view the certificate details directly from the .pem file (not of the certificate in the keystore)?

2240
  • 1,570
  • 2
  • 7
  • 23
Ashwin
  • 11,453
  • 31
  • 108
  • 179

2 Answers2

405

An alternative to using keytool, you can use the command

openssl x509 -in certificate.pem -text

This should work for any x509 .pem file provided you have openssl installed.

Cristian Ciupitu
  • 19,240
  • 7
  • 48
  • 73
StampyCode
  • 6,099
  • 2
  • 25
  • 43
  • 7
    Actually, `keytool` errored out with `java.lang.Exception: Failed to parse input` for some pems, but this worked for all of them – Csaba Toth Apr 13 '18 at 18:23
  • If you want the aliases only: `openssl x509 -in file.pem -text | grep -A 1 'Alternative Name'` – qräbnö Jul 11 '18 at 10:27
  • 4
    In my case I had to change "x509" with "rsa" so I guess it depends on the .pem contents. I used `file` command to know that it was "rsa" and not "x509" (e.g. `file xyz.pem`). – MegaTux May 22 '19 at 19:40
  • 9
    @megatux a PEM file can contain a few different types of data `x509` is the format for certificates, `rsa` is the format for a public/private key pair. – alfwatt Jun 07 '19 at 22:46
  • 1
    A rookie approach is to open the pem file using Firefox – GMaster Aug 19 '20 at 17:27
  • 4
    For shorter text-output try: `openssl x509 -in certificate.pem -text -noout` - This will omit the last ~ 40 lines of text from the output ( BEGIN CERTIFICATE ... END CERTIFICATE stuff) – knb Oct 22 '20 at 12:28
  • 1
    to get only the subject: `openssl x509 -noout -subject -in file.pem` –  Oct 23 '20 at 07:23
  • 1
    didn't upvote because I liked the 404 upvotes :) – zentrunix May 26 '22 at 17:56
211

Use the -printcert command like this:

keytool -printcert -file certificate.pem
Cristian Ciupitu
  • 19,240
  • 7
  • 48
  • 73
Drona
  • 6,482
  • 1
  • 27
  • 35
  • 35
    I am getting the error java.lang.Exception: Failed to parse input – maxisme Jun 06 '14 at 00:19
  • 13
    @Maximilian it may happen on APNS certificates, which combines private key & certificate into one `.pem`. Separate them into 2 files using text editor and the above command will work. (Hint: copy `-- BEGIN CERTIFICATE --` line to `-- END CERTIFICATE --` line to new file) – Raptor Jan 02 '15 at 04:13
  • 1
    needs java (jdk or jre) – Pieter Nov 14 '16 at 01:57
  • Check the name of your pem file. – tksilicon Feb 16 '20 at 06:03