OPENSSL-X509(1ssl) OpenSSL OPENSSL-X509(1ssl) (NAME) openssl-x509 - (SYNOPSIS) openssl x509 [-help] [-in filename|uri] [-passin arg] [-new] [-x509toreq] [-req] [-copy_extensions arg] [-inform DER|PEM] [-vfyopt nm:v] [-key filename|uri] [-keyform DER|PEM|P12|ENGINE] [-signkey filename|uri] [-out filename] [-outform DER|PEM] [-nocert] [-noout] [-dateopt] [-text] [-certopt option] [-fingerprint] [-alias] [-serial] [-startdate] [-enddate] [-dates] [-subject] [-issuer] [-nameopt option] [-email] [-hash] [-subject_hash] [-subject_hash_old] [-issuer_hash] [-issuer_hash_old] [-ext extensions] [-ocspid] [-ocsp_uri] [-purpose] [-pubkey] [-modulus] [-multi] [-checkend num] [-checkhost host] [-checkemail host] [-checkip ipaddr] [-set_serial n] [-next_serial] [-not_before date] [-not_after date] [-days arg] [-preserve_dates] [-set_issuer arg] [-set_subject arg] [-subj arg] [-force_pubkey filename] [-clrext] [-extfile filename] [-extensions section] [-sigopt nm:v] [-badsig] [-digest] [-CA filename|uri] [-CAform DER|PEM|P12] [-CAkey filename|uri] [-CAkeyform DER|PEM|P12|ENGINE] [-CAserial filename] [-CAcreateserial] [-trustout] [-setalias arg] [-clrtrust] [-addtrust arg] [-clrreject] [-addreject arg] [-rand files] [-writerand file] [-engine id] [-provider name] [-provider-path path] [-provparam [name:]key=value] [-propquery propq] (DESCRIPTION) . (CSR) (self-signing) <>> (<>) . X.509 . x509v3_config(5) . . (OPTIONS) (Input, Output, and General Purpose Options) -help . -in filename|uri -req. . -new . -passin arg . arg openssl-passphrase-options(1) . -new . -in -req . -set_subject . -force_pubkey -key ( -signkey) . -x509toreq PKCS#10 ( ). -key ( -signkey) subjectPKInfo . X.509 . X.509 -extfile . -req . PKCS#10 . X.509 . X.509 -extfile . -copy_extensions arg X.509 -x509toreq -req . arg none . arg copy copyall (subject identifier) (authority key identifier) . -ext . -inform DER|PEM PEM . openssl-format-options(1) . -vfyopt nm:v . . -key filename|uri . -force_pubkey . -CA . ( ). -preserve_dates -days . -not_before -not_after . -signkey filename|uri -key . -keyform DER|PEM|P12|ENGINE . openssl-format-options(1) . -out filename . -outform DER|PEM PEM . openssl-format-options(1) . -nocert ( ). -noout . (Certificate Printing Options) : -alias -purpose << >> (Trust Settings) . -dateopt . : rfc_822 iso_8601. rfc_822 . -text . . -certopt option -text. option . -certopt . << >> (Text Printing Flags) . -fingerprint (digest) DER ( digest ). <<>> (fingerprint) . . -alias << >> (nickname) . -serial . -startdate notBefore. -enddate notAfter. -dates . -subject (subject). -issuer (issuer). -nameopt option . openssl-namedisplay-options(1) . -email () (email) . -hash <<-subject_hash>> . -subject_hash <<>> . OpenSSL . -subject_hash_old <<>> 1.0.0 OpenSSL . -issuer_hash <<>> . -issuer_hash_old <<>> 1.0.0 OpenSSL . -ext extensions . . "subjectAltName, subjectKeyIdentifier". x509v3_config(5) . -ocspid OCSP . -ocsp_uri () OCSP . -purpose . << >> openssl-verification-options(1) . -pubkey SubjectPublicKeyInfo PEM . -modulus (modulus) . -multi . (Certificate Checking Options) -checkend arg -multi arg . -multi arg . -checkhost host . -checkemail email . -checkip ipaddr IP . (Certificate Output Options) -set_serial n . -key -signkey -CA . -CA ( -CAserial ) . (decimal) ( "0x" ) . -next_serial . -not_before date . YYMMDDHHMMSSZ ( ASN1 UTCTime) YYYYMMDDHHMMSSZ ( ASN1 GeneralizedTime) . SS Z . "today" () . -preserve_dates . -not_after date . YYMMDDHHMMSSZ ( ASN1 UTCTime) YYYYMMDDHHMMSSZ ( ASN1 GeneralizedTime) . SS Z . "today" () . -preserve_dates . -days . -days arg . . -preserve_dates . -not_after . -preserve_dates <> <> . -days -not_before -not_after . -set_issuer arg . -set_subject . -set_subject arg . -set_issuer . "/type0=value0/type1=value1/type2=..." . "\" ( / backslash) . . "/" RDN ( NULL-DN) . RDN "+" "/" AttributeValueAssertion (AVA) . : "/DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe" -new -force_pubkey . -subj arg -set_subject . -force_pubkey filename -key ( -signkey). . -new -set_subject . DH. -clrext . -clrext . . -extfile filename X.509 . -extensions section extfile X.509 . () "extensions" . x509v3_config(5) . x509v3_config(5) . -sigopt nm:v . . . -badsig . -digest . -fingerprint -key -CA. openssl-dgst(1) . SHA1 -fingerprint SHA256 . CA (Micro-CA Options) -CA filename|uri <> . <>> (<>) : <> <> . -key ( -signkey) . -req CSR . -req -new . -CAform DER|PEM|P12, CA . openssl-format-options(1) . -CAkey filename|uri CA . -CA . -CA . -CAkeyform DER|PEM|P12|ENGINE CA . openssl-format-options(1) . -CAserial filename CA . -CA . . . CA .srl . CA mycacert.pem mycacert.srl . -CA <-CAserial> <-CAcreateserial> . -CAcreateserial -CA CA . . (Trust Settings) (trusted certificate) << >> (nickname / alias). << >> . CA (Root CA) : CA . CA . CA . CA SSL SSL . openssl-verification-options(1) . OpenSSL CA. -trustout PEM ( ) . . -trustout . . -setalias arg << >> (alias) . "Steve's Certificate". -clrtrust . -addtrust arg . clientAuth serverAuth emailProtection anyExtendedKeyUsage . OpenSSL 1.1.0 . OpenSSL . -clrreject . -addreject arg (trust anchor) . -addtrust . (Generic options) -rand files, -writerand file << >> openssl(1) . -engine id << >> openssl(1) . . -provider name -provider-path path -provparam [name:]key=value -propquery propq << >> openssl(1) provider(7) property(7) . (Text Printing Flags) certopt text . . compatible . . no_header : "Certificate" "Data" . no_version . no_serial . no_signame . no_validity notBefore notAfter. no_subject . no_issuer . no_pubkey . no_sigdump . no_aux . no_extensions X509V3. ext_default : . ext_error . ext_parse ASN1 . ext_dump . ca_default openssl-ca(1) no_issuer no_pubkey no_header no_version. (EXAMPLES) : '\' . : openssl x509 -in cert.pem -noout -text <> ( ) : openssl x509 -in cert.pem -noout -ext subjectAltName : openssl x509 -in cert.pem -noout -ext subjectAltName,nsCertType : openssl x509 -in cert.pem -noout -serial : openssl x509 -in cert.pem -noout -subject RFC2253: openssl x509 -in cert.pem -noout -subject -nameopt RFC2253 (oneline) UTF8 : openssl x509 -in cert.pem -noout -subject -nameopt oneline,-esc_msb SHA1 : openssl x509 -sha1 -in cert.pem -noout -fingerprint PEM DER: openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER : openssl x509 -x509toreq -in cert.pem -out req.pem -key key.pem CA: openssl x509 -req -in careq.pem -extfile openssl.cnf -extensions v3_ca \ -key key.pem -out cacert.pem CA : openssl x509 -req -in req.pem -extfile openssl.cnf -extensions v3_usr \ -CA cacert.pem -CAkey key.pem -CAcreateserial SSL "Steve's Class 1 CA": openssl x509 -in cert.pem -addtrust clientAuth \ -setalias "Steve's Class 1 CA" -out trust.pem ( ): openssl x509 -in chain.pem -multi -checkend $[3600*24*30] \ && echo 'perform renewal' || echo 'renewal unnecessary' (NOTES) UTF8 T61String ISO8859-1 . Netscape MSIE . . -email (subject alternative name) . : . (BUGS) X.509 : . . (SEE ALSO) openssl(1), openssl-req(1), openssl-ca(1), openssl-genrsa(1), openssl-gendsa(1), openssl-verify(1), x509v3_config(5) (HISTORY) -subject_hash -issuer_hash OpenSSL 1.0.0 MD5 (distinguished name DN) . OpenSSL 1.0.0 DN SHA1 . openssl-rehash(1) . -signkey OpenSSL 3.0 -key . -engine OpenSSL 3.0 . -C OpenSSL 3.0 . OpenSSL 3.2 X.509 . (COPYRIGHT) - OpenSSL. . . (<<>>) . . LICENSE . 3.6.4 2026-08-25 OPENSSL-X509(1ssl)